CVE-2022-37145
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk55th percentile - higher than 55% of all known CVEs
Summary
The PlexTrac platform prior to version 1.17.0 does not restrict excessive authentication attempts for accounts using the built-in authentication provider. An unauthenticated remote attacker can perform a brute-force attack on the login page with no time or attempt limitations.
Risk Assessment
The risk involves potential account takeover through brute-force attacks, leading to unauthorized access to sensitive data and penetration test reports.
Recommendation
Immediately upgrade PlexTrac to version 1.17.0 or later, which introduces login attempt restrictions.
Other vulnerabilities in PlexTrac
See all- CVE-2022-37146Medium
A vulnerability in the PlexTrac platform prior to version 1.28.0 allows username enumeration via HTTP response time differences on invalid login attempts for accounts configured with the PlexTrac authentication provider. An unauthenticated remote attacker can identify valid, unlocked user accounts.
- CVE-2022-37144High
The PlexTrac platform prior to API version 1.17.0 does not restrict excessive MFA TOTP submission attempts. An unauthenticated remote attacker in possession of a valid username and password can bruteforce their way past MFA protections to login as the targeted user.
Original NVD description (English source)
The PlexTrac platform prior to version 1.17.0 does not restrict excessive authentication attempts for accounts configured to use the PlexTrac authentication provider. An unauthenticated remote attacker could perform a bruteforce attack on the login page with no time or attempt limitation in an attempt to obtain valid credentials for the platform users configured to use the PlexTrac authentication provider.