CVE-2022-36243mediumCWE-548

CVE-2022-36243: medium-severity vulnerability in Shop Beat studio

Directory Traversal on Shop Beat Services

Published · Updated

Follow this CVE+ Monitor studio

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.7%
Shop Beat Solutions (pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Directory Traversal via server.shopbeat.co.za. Information Exposure Through Directory Listing vulnerability in "studio" software of Shop Beat. This issue affects: Shop Beat studio studio versions prior to 3.2.57 on arm.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
Shop Beat · studio
Related CVEs — Shop Beat studio

In the same product, most dangerous first.

CVE-2022-36246CRITICALShop Beat Services Vulnerable To Insecure PermissionsEPSS 0.7%CVE-2022-36247CRITICALShop Beat Services Vulnerable To IDOREPSS 0.5%CVE-2022-36249MEDIUMShop Beat Services Vulnerable To Bypass 2FA via APIsEPSS 0.4%CVE-2022-36244MEDIUMMultiple Stored Cross-Site Scripting Vulnerabilities on Shop Beat ServicesEPSS 0.3%CVE-2022-36250HIGHCross Site Request Forgery on Shop Beat ServicesEPSS 0.3%