CVE-2022-37144
High
Description
The PlexTrac platform prior to API version 1.17.0 does not restrict excessive MFA TOTP submission attempts. An unauthenticated remote attacker in possession of a valid username and password can bruteforce their way past MFA protections to login as the targeted user.
SeverityHigh
CVSS8.8
Exploit probability—
ProductPlextrac
PublishedSep 8, 2022
First seenSep 8, 2022
How to fix
Update
- plextrac plextrac1.17.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| plextrac plextrac | v < 1.17.0 | 1.17.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.