CVE-2022-23061: Shopizer - IDOR delete superadmin
Published May 1, 2022
·Updated
In Shopizer versions 2.0 to 2.17.0 a regular admin can permanently delete a superadmin (although this cannot happen according to the documentation) via Insecure Direct Object Reference (IDOR) vulnerability.
Affected Software
1 affected component
Shopizer Shopizer>=2.0<=2.17.0
Remediation
Information
Upgrade version to 3.0.0 or higher
Event History
May 1, 2022
CVE Published
via MITRE·12:40 PM
Data Sourced
via MITRE·12:40 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2022-23061?
CVE-2022-23061 has a medium severity level due to its potential impact on user roles and permissions.
2
How do I fix CVE-2022-23061?
To fix CVE-2022-23061, upgrade Shopizer to version 2.18.0 or later.
3
What types of attacks can CVE-2022-23061 enable?
CVE-2022-23061 can enable unauthorized deletion of superadmin accounts by regular admin users.
4
What are the affected versions by CVE-2022-23061?
CVE-2022-23061 affects Shopizer versions from 2.0 to 2.17.0.
5
Is CVE-2022-23061 a common vulnerability?
CVE-2022-23061 represents a common security issue related to Insecure Direct Object References (IDOR) in web applications.