1. Home
  2. CVE Database
  3. CVE-2022-36249
MEDIUM · 5.4

CVE-2022-36249

Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Bypass 2FA via APIs. For Controlpanel Lite. "After login we are directly able to use the bearer token or jsess...

Vulnerability Description

Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Bypass 2FA via APIs. For Controlpanel Lite. "After login we are directly able to use the bearer token or jsession ID to access the apis instead of entering the 2FA code. Thus, leading to bypass of 2FA on API level.

CVSS Score

5.4

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
ShopbeatShop Beat Media Player>= 2.5.95, < 3.2.57

Related Weaknesses (CWE)

CWE-306CWE-288

References

FAQ

What is CVE-2022-36249?

CVE-2022-36249 is a vulnerability with a CVSS score of 5.4 (MEDIUM). Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Bypass 2FA via APIs. For Controlpanel Lite. "After login we are directly able to use the bearer token or jsess...

How severe is CVE-2022-36249?

CVE-2022-36249 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-36249?

Check the references section above for vendor advisories and patch information. Affected products include: Shopbeat Shop Beat Media Player.