CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2022-37146
https://notcve.org/view.php?id=CVE-2022-37146
08 Sep 2022 — The PlexTrac platform prior to version 1.28.0 allows for username enumeration via HTTP response times on invalid login attempts for users configured to use the PlexTrac authentication provider. Login attempts for valid, unlocked users configured to use PlexTrac as their authentication provider take significantly longer than those for invalid users, allowing for valid users to be enumerated by an unauthenticated remote attacker. Note that the lockout policy implemented in Plextrac version 1.17.0 makes it imp... • http://plextrac.com • CWE-203: Observable Discrepancy •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-37145
https://notcve.org/view.php?id=CVE-2022-37145
08 Sep 2022 — The PlexTrac platform prior to version 1.17.0 does not restrict excessive authentication attempts for accounts configured to use the PlexTrac authentication provider. An unauthenticated remote attacker could perform a bruteforce attack on the login page with no time or attempt limitation in an attempt to obtain valid credentials for the platform users configured to use the PlexTrac authentication provider. La plataforma PlexTrac versiones anteriores a 1.17.0 no restringe los intentos de autenticación excesi... • http://plextrac.com • CWE-307: Improper Restriction of Excessive Authentication Attempts •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-37144
https://notcve.org/view.php?id=CVE-2022-37144
08 Sep 2022 — The PlexTrac platform prior to API version 1.17.0 does not restrict excessive MFA TOTP submission attempts. An unauthenticated remote attacker in possession of a valid username and password can bruteforce their way past MFA protections to login as the targeted user. La plataforma PlexTrac versiones anteriores a 1.17.0, de la API no restringe los intentos excesivos de envío de MFA TOTP. Un atacante remoto no autenticado en posesión de un nombre de usuario y una contraseña válidos puede pasar por la fuer... • http://plextrac.com • CWE-307: Improper Restriction of Excessive Authentication Attempts •