CVE-2022-37144

HIGH

PlexTrac < 1.17.0 - Unauthenticated MFA Bypass via Excessive TOTP Attempts

Title source: llm
STIX 2.1

Description

The PlexTrac platform prior to API version 1.17.0 does not restrict excessive MFA TOTP submission attempts. An unauthenticated remote attacker in possession of a valid username and password can bruteforce their way past MFA protections to login as the targeted user.

References (2)

Core 2
Core References
Product x_refsource_misc
http://plextrac.com
Technical Description, Third Party Advisory x_refsource_misc
https://www.controlgap.com/blog/a-plextrac-story

Scores

CVSS v3 8.8
EPSS 0.0079
EPSS Percentile 51.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-307
Status published
Products (1)
plextrac/plextrac < 1.17.0
Published Sep 08, 2022
Tracked Since Feb 18, 2026