CVE-2022-37144
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
The PlexTrac platform prior to API version 1.17.0 does not restrict excessive MFA TOTP submission attempts. An unauthenticated remote attacker in possession of a valid username and password can bruteforce their way past MFA protections to login as the targeted user.
Risk Assessment
The risk is that an attacker with valid credentials can bypass MFA and gain unauthorized access to user accounts, potentially compromising sensitive data and platform functionality.
Recommendation
Immediately update the PlexTrac platform to API version 1.17.0 or later, which introduces rate limiting for MFA TOTP attempts.
Other vulnerabilities in PlexTrac
See all- CVE-2022-37146Medium
A vulnerability in the PlexTrac platform prior to version 1.28.0 allows username enumeration via HTTP response time differences on invalid login attempts for accounts configured with the PlexTrac authentication provider. An unauthenticated remote attacker can identify valid, unlocked user accounts.
- CVE-2022-37145High
The PlexTrac platform prior to version 1.17.0 does not restrict excessive authentication attempts for accounts using the built-in authentication provider. An unauthenticated remote attacker can perform a brute-force attack on the login page with no time or attempt limitations.
Original NVD description (English source)
The PlexTrac platform prior to API version 1.17.0 does not restrict excessive MFA TOTP submission attempts. An unauthenticated remote attacker in possession of a valid username and password can bruteforce their way past MFA protections to login as the targeted user.