PT-2023-13462 · Shop Beat Solutions · Shop Beat Media Player+1

Published 2023-05-30 · Updated 2025-01-13 · CVE-2022-36243

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Shop Beat Media Player versions 2.5.95 through 3.2.57 Shop Beat studio versions prior to 3.2.57

Description The issue affects Shop Beat Solutions, specifically the Shop Beat Media Player and Shop Beat studio software. It is related to a Directory Traversal vulnerability via the server.shopbeat.co.za endpoint, as well as an Information Exposure Through Directory Listing vulnerability.

Recommendations For Shop Beat Media Player versions 2.5.95 through 3.2.57, update to a version later than 3.2.57. For Shop Beat studio versions prior to 3.2.57, update to a version later than 3.2.57. As a temporary workaround, consider restricting access to the server.shopbeat.co.za endpoint until a patch is available.

Fix

Path traversal

Weakness Enumeration

CWE-22

CWE-548

Related Identifiers

CVE-2022-36243

Affected Products

Shop Beat Media Player

Shop Beat Studio

References · 4

• https://osv.dev/vulnerability/CVE-2022-36243 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36243 · Security Note
• https://t.me/cvenotify/51415 · Telegram Post
• https://shopbeat.co.za · Note