CVE-2022-36249 Vulnerability Details

  /     /     /  

CVE-2022-36249 Metadata Quick Info

CVE Published: 30/05/2023 | CVE Updated: 03/08/2024 | CVE Year: 2022
Source: ShopBeat | Vendor: Shop Beat | Product: studio
Status : PUBLISHED

---

CVE-2022-36249 Description

Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Bypass 2FA via APIs. For Controlpanel Lite. "After login we are directly able to use the bearer token or jsession ID to access the apis instead of entering the 2FA code. Thus, leading to bypass of 2FA on API level.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-288
CWE Name: CWE-288 Authentication Bypass Using an Alternate Path or Channel
Source: Shop Beat

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).