Skip to main content

Shopizer CVE-2022-23061

MEDIUM
Authorization Bypass Through User-Controlled Key (CWE-639)
2022-05-01 vulnerabilitylab@mend.io
Authentication Bypass Shopizer
6.5
CVSS 3.1 · Vendor: mend
Share

Severity by source

Vendor (mend) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Primary rating from Vendor (mend) · only source for this CVE.

CVSS VectorVendor: mend

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
May 01, 2022 - 13:15 cve.org
MEDIUM 6.5

DescriptionCVE.org

In Shopizer versions 2.0 to 2.17.0 a regular admin can permanently delete a superadmin (although this cannot happen according to the documentation) via Insecure Direct Object Reference (IDOR) vulnerability.

AnalysisAI

In Shopizer versions 2.0 to 2.17.0 a regular admin can permanently delete a superadmin (although this cannot happen according to the documentation) via Insecure Direct Object Reference (IDOR). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified under CWE-639. In Shopizer versions 2.0 to 2.17.0 a regular admin can permanently delete a superadmin (although this cannot happen according to the documentation) via Insecure Direct Object Reference (IDOR) vulnerability. Affected products include: Shopizer.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Shopizer

View all
CVE-2022-23063 HIGH POC
8.8 May 03

In Shopizer versions 2.3.0 to 3.0.1 are vulnerable to Insufficient Session Expiration. Rated high severity (CVSS 8.8), t
CVE-2014-4963 MEDIUM POC
6.8 Jul 15

Shopizer 1.1.5 and earlier allows remote attackers to modify the account settings of arbitrary users via the customer.cu
CVE-2014-4962 MEDIUM POC
6.4 Jul 15

Shopizer 1.1.5 and earlier allows remote attackers to reduce the total cost of their shopping cart via a negative number
CVE-2014-4964 MEDIUM POC
6.8 Jul 15

Multiple cross-site request forgery (CSRF) vulnerabilities in Shopizer 1.1.5 and earlier allow remote attackers to hijac
CVE-2014-5385 MEDIUM POC
5.0 Aug 21

com/salesmanager/central/profile/ProfileAction.java in Shopizer 1.1.5 and earlier does not restrict the number of authen
CVE-2014-4965 MEDIUM POC
4.3 Jul 15

Multiple cross-site scripting (XSS) vulnerabilities in Shopizer 1.1.5 and earlier allow remote attackers to inject arbit
CVE-2022-23060 MEDIUM POC
4.8 May 01

A Stored Cross Site Scripting (XSS) vulnerability exists in Shopizer versions 2.0 through 2.17.0, where a privileged use
CVE-2022-23059 MEDIUM POC
4.8 Mar 29

A Stored Cross Site Scripting (XSS) vulnerability exists in Shopizer versions 2.0 through 2.17.0 via the “Manage Images”
CVE-2021-33562 MEDIUM POC
4.8 May 24

A reflected cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitra
CVE-2021-33561 MEDIUM POC
4.8 May 24

A stored cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary

CVE-2020-11007 MEDIUM
6.5 Apr 16

In Shopizer before version 2.11.0, using API or Controller based versions negative quantity is not adequately validated

CVE-2020-11006 MEDIUM
5.4 May 08

In Shopizer before version 2.11.0, a script can be injected in various forms and saved in the database, then executed wh

Same weakness CWE-639 – Authorization Bypass Through User-Controlled Key

View all
CVE-2024-50483 CRITICAL
9.8
CVE-2026-55255 HIGH POC
8.4
CVE-2025-3605 CRITICAL POC
9.8
CVE-2022-3805 HIGH POC
8.6
CVE-2025-5947 CRITICAL POC
9.8
CVE-2020-36923 CRITICAL POC
9.8
CVE-2023-3048 CRITICAL POC
9.8
CVE-2024-27730 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2022-23061 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy