CVE-2022-36249 - CVE House
Back to Database
Status published Unknown CVE-2022-36249

Shop Beat Services Vulnerable To Bypass 2FA via APIs

Vulnerability Description

Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Bypass 2FA via APIs. For Controlpanel Lite. "After login we are directly able to use the bearer token or jsession ID to access the apis instead of entering the 2FA code. Thus, leading to bypass of 2FA on API level.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-36249

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Shop Beat thanks Emirates National Oil Company Limited (ENOC) LLC for the above discovery.

References

More from Shop Beat

View All →
CVE-2022-36250
Cross Site Request Forgery on Shop Beat Services
Unknown 0
CVE-2022-36247
Shop Beat Services Vulnerable To IDOR
Unknown 0
CVE-2022-36246
Shop Beat Services Vulnerable To Insecure Permissions
Unknown 0
CVE-2022-36244
Multiple Stored Cross-Site Scripting Vulnerabilities on Shop Beat Services
Unknown 0
CVE-2022-36243
Directory Traversal on Shop Beat Services
Unknown 0

Affected Vendor

Affected Software

studio
Vulnerable Versions:
studio

Timeline

Official Publish: May 30th, 2023
Last Modified: January 13th, 2025
Added to House: July 21st, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

CWE-288

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1550 Use Alternate Authentication Material
Defense Evasion
T1021 Remote Services
Lateral Movement
T1098 Account Manipulation
Privilege Escalation