Cyber Resilience

CVE-2023-3747

Cloudflare Warp 6.29

Published
07 September 2023
Modified
21 November 2024
Patch / advisory
View advisory
CVSS Score v3.1 5.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS Score 0.0018 8th percentile
Risk Priority 41 floored blend · peak EPSS

Summary

CVE-2023-3747 is a medium-severity Client-Side Enforcement of Server-Side Security (CWE-602) vulnerability in Cloudflare Warp. Its CVSS base score is 5.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Web Session Cookie (T1550.004); ranked at the 8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A06:2025 Insecure DesignA08:2025 Software or Data Integrity Failures

EU & UK References

Vulnerability Data

Zero Trust Administrators have the ability to disallow end users from disabling WARP on their devices. Override codes can also be created by the Administrators to allow a device to temporarily be disconnected from WARP, however, due to lack of…

more

server side validation, an attacker with local access to the device, could extend the maximum allowed disconnected time of WARP client granted by an override code by changing the date & time on the local device where WARP is running.

CWE(s)
CWE-602CWE-565

Related Threats

MITRE ATT&CK Enterprise Techniques

T1550.004 Web Session Cookie Lateral Movement
Adversaries can use stolen session cookies to authenticate to web applications and services.
attack.mitre.org →
T1185 Browser Session Hijacking Collection
Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1539 Steal Web Session Cookie Credential Access
An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.
attack.mitre.org →
T1550 Use Alternate Authentication Material Lateral Movement
Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-0238Same product: Cloudflare Warp
CVE-2023-1862Same product: Cloudflare Warp
CVE-2023-2754Same product: Cloudflare Warp
CVE-2023-0652Same product: Cloudflare Warp
CVE-2023-0654Same product: Cloudflare Warp
CVE-2025-0651Same product: Cloudflare Warp
CVE-2023-1412Same product: Cloudflare Warp
CVE-2023-3348Same vendor: Cloudflare
CVE-2026-2833Same vendor: Cloudflare
CVE-2026-2835Same vendor: Cloudflare

Affected Assets

cloudflare
warp
6.29

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V10.7.1
  • V2.2.2
  • V8.3.1
  • V10.4.1

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-04 full match
prevents

Cookies commonly carry identity assertions; requiring their protection, conveyance, and verification directly eliminates the weakness.

PR.AA-03 mostly match
prevents

Strong authentication mechanisms reduce reliance on unvalidated cookies for identity and access decisions.

PR.DS-02 mostly match
prevents

Cryptographic integrity for data-in-transit directly mitigates tampering of cookies sent over the network.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly prevent design flaws that place server security enforcement on the client.

PR.AA-05 partial match
prevents

Proper policy-based enforcement of authorizations implies server-side controls rather than client-only checks.

PR.DS-01 partial match
prevents

Integrity protections for data-at-rest can apply to cookie stores but do not cover validation during use.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.27 Secure system architecture and engineering principles mostly match
prevents

Secure architecture principles discourage client-side trust but do not directly address this weakness.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect client-side enforcement but is not the primary mitigation.

A.8.3 Information access restriction mostly match
prevents

Information access restriction is undermined when the client is trusted to enforce it.

A.8.25 Secure development life cycle partial match
prevents

Secure development lifecycle mandates server-side validation and prevents reliance on client enforcement.

A.8.26 Application security requirements partial match
prevents

Application security requirements explicitly call for server-side enforcement of security mechanisms.

A.8.28 Secure coding partial match
prevents

Secure coding standards require server-side checks and reject client-only enforcement.

References