PT-2022-23837 · Plextrac · Plextrac

Published 2022-09-08 · Updated 2022-09-13 · CVE-2022-37145

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions PlexTrac versions prior to 1.17.0

Description The issue allows an unauthenticated remote attacker to perform a brute-force attack on the login page with no time or attempt limitation, potentially obtaining valid credentials for platform users configured to use the PlexTrac authentication provider.

Recommendations For versions prior to 1.17.0, update to version 1.17.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the login page or implementing additional authentication measures to minimize the risk of exploitation.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2022-37145

Affected Products

Plextrac

References · 4

• https://osv.dev/vulnerability/CVE-2022-37145 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-37145 · Security Note
• https://controlgap.com/blog/a-plextrac-story · Note
• http://plextrac.com · Note