CVE-2022-23061

2022-05-0113:15:07

Google

osv.dev

6.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

32.1%

JSON

In Shopizer versions 2.0 to 2.17.0 a regular admin can permanently delete a superadmin (although this cannot happen according to the documentation) via Insecure Direct Object Reference (IDOR) vulnerability.

CPENameOperatorVersion
shopizereq2.16.0
shopizereq2.13.0
shopizereq2.14.1
shopizereq2.15.0
shopizereq2.17.0
shopizereq2.14.0

Name	Operator	Version
shopizer	eq	2.16.0
shopizer	eq	2.13.0
shopizer	eq	2.14.1
shopizer	eq	2.15.0
shopizer	eq	2.17.0
shopizer	eq	2.14.0

References

github.com/shopizer-ecommerce/shopizer/commit/6b9f1ecd303b3b724d96bd08095c1a751dcc287e

www.whitesourcesoftware.com/vulnerability-database/CVE-2022-23061