CVE-2020-35152: 
NixOS vulnerability analysis and mitigation

Cloudflare WARP for Windows was discovered to contain a privilege escalation vulnerability (CVE-2020-35152) due to an unquoted service path issue. The vulnerability affected versions prior to 1.2.2695.1 and was disclosed on February 2, 2021. A malicious user or process running with non-administrative privileges could exploit this vulnerability to elevate their privileges to administrator level (Cloudflare Advisory).

The vulnerability is classified as CWE-428 (Unquoted Search Path or Element). The CVSS v3.1 base scores vary between sources, with NVD assigning a HIGH severity score of 7.8 (Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) while Cloudflare assigned a MEDIUM severity score of 4.5 (Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) (NVD).

The vulnerability could allow a malicious user or process with non-administrative privileges to escalate their privileges to administrator level, potentially gaining full control over the affected system (NVD).

The vulnerability requires local access to the system and low privileges to exploit. The attack complexity is considered low according to NVD's assessment, though Cloudflare's assessment suggests higher complexity (NVD).

The vulnerability was fixed in version 1.2.2695.1 by adding quotes around the service's binary path. Users are advised to upgrade to this version or later to protect against this vulnerability (Cloudflare Advisory).