CVE-2022-37144

The PlexTrac platform prior to API version 1.17.0 does not restrict excessive MFA TOTP submission attempts

published September 8, 2022

CVSS
—
EPSS
1%
Percentile
60.5
In the wild
Unconfirmed
What it is

The PlexTrac platform prior to API version 1.17.0 does not restrict excessive MFA TOTP submission attempts. An unauthenticated remote attacker in possession of a valid username and password can bruteforce their way past MFA protections to login as the targeted user.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00937 · 60.5th percentile
Published
2022-09-08T00:27Z
EPSS history
Timeline
  • 08 SEP 00:27Z
    The PlexTrac platform prior to API version 1.17.0 does not restrict excessive MFA TOTP submission attempts
    cvelistv5