CVE-2022-36249

CVE-2022-36249: Shop Beat Services Vulnerable To Bypass 2FA via APIs

Vendor Shop Beat

Product studio

Weakness CWE-288

Published May 30, 2023

Last update January 13, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Bypass 2FA via APIs. For Controlpanel Lite. "After login we are directly able to use the bearer token or jsession ID to access the apis instead of entering the 2FA code. Thus, leading to bypass of 2FA on API level.

Key dates

02Disclosure timeline

May 30, 2023 CVE published

January 13, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-36249 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/288.html

Related vulnerabilities

04Related CVE

CVE-2025-58133 Zoom Rooms Clients - Authentication Bypass CVE-2021-32984 Automation Direct CLICK PLC CPU Modules Authentication Bypass Using an Alternate Path or Channel CVE-2021-41292 ECOA BAS controller - Broken Authentication CVE-2025-6895 MelaPress Login Security 2.1.0 - 2.1.1 - Authentication Bypass to Privilege Escalation via get_valid_user_based_on_token Function CVE-2025-11534 Authentication Bypass Using an Alternate Path or Channel in Raisecomm RAX701-GC Series