PlexTrac vulnerabilities
3 known CVE vulnerabilities in PlexTrac, translated and rated.
- CVE-2022-37146Medium
A vulnerability in the PlexTrac platform prior to version 1.28.0 allows username enumeration via HTTP response time differences on invalid login attempts for accounts configured with the PlexTrac authentication provider. An unauthenticated remote attacker can identify valid, unlocked user accounts.
- CVE-2022-37145High
The PlexTrac platform prior to version 1.17.0 does not restrict excessive authentication attempts for accounts using the built-in authentication provider. An unauthenticated remote attacker can perform a brute-force attack on the login page with no time or attempt limitations.
- CVE-2022-37144High
The PlexTrac platform prior to API version 1.17.0 does not restrict excessive MFA TOTP submission attempts. An unauthenticated remote attacker in possession of a valid username and password can bruteforce their way past MFA protections to login as the targeted user.