CVE-2022-36249 — Shop Beat Services Vulnerable To Bypass 2FA via APIs

CVE-2022-36249

Shop Beat Services Vulnerable To Bypass 2FA via APIs PUBLISHED

Description (CNA)

Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Bypass 2FA via APIs. For Controlpanel Lite. "After login we are directly able to use the bearer token or jsession ID to access the apis instead of entering the 2FA code. Thus, leading to bypass of 2FA on API level.

Affected (CNA)

Vendor / product	Versions
Shop Beat / studio	affected studio before 3.2.57

CWE

CWE-288

References

https://www.shopbeat.co.za

ADP enrichment

CVE

No English description supplied.

https://www.shopbeat.co.za

CISA-ADP

No English description supplied.

No references supplied.