Read the docs
TI-2022-16612 Aliases CVE-2022-36246GHSA-3f3f-3r46-6862

Shop Beat Services Vulnerable To Insecure Permissions

Priority MEDIUM 50CWE-264Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-264.

Summary

Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Insecure Permissions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00677 52nd percentileScored 2026-11-07
Fix Fixed studio (Shop Beat): 3.2.57

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Shop Beatstudiostudio to before 3.2.573.2.57Patch availableCNA
  • studio VendorShop Beat Affected studio to before 3.2.57 Fixed in 3.2.57 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:shopbeat:shop_beat_media_player:*:*:*:*:*:*:arm:*2.5.95 to before 3.2.57VulnerableShop Beat
  • cpe:2.3:a:shopbeat:shop_beat_media_player:*:*:*:*:*:*:arm:* Versions 2.5.95 to before 3.2.57 Vulnerable ·Shop Beat

Remediation

  • Fix · CNA studio (Shop Beat) Fixed in 3.2.57

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Shop Beat studio 3.2.57

    6 records Highest priority Priority MEDIUM 3 MEDIUM, 3 LOW

    Other records, highest priority first

    • TI-2022-16613 Shop Beat Services Vulnerable To IDORPriority MEDIUM 48
    • TI-2022-16615 Cross Site Request Forgery on Shop Beat ServicesPriority MEDIUM 40
    • TI-2022-16610 Directory Traversal on Shop Beat ServicesPriority LOW 31
    Show all 6 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-36246
  2. 2026-10-03 Alias added: GHSA-3f3f-3r46-6862

References

Other 1

  • TI-2022-16613 Shop Beat Services Vulnerable To IDOR CVSS 3.1CRITICAL 9.1
  • TI-2022-16615 Cross Site Request Forgery on Shop Beat Services CVSS 3.1HIGH 8.8
  • TI-2022-16610 Directory Traversal on Shop Beat Services CVSS 3.1MEDIUM 5.3
  • TI-2022-16614 Shop Beat Services Vulnerable To Bypass 2FA via APIs CVSS 3.1MEDIUM 5.4
  • TI-2022-16611 Multiple Stored Cross-Site Scripting Vulnerabilities on Shop Beat Services CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences