CVE-2022-37144

8.8 highEPSS 0.9%

High (8.8) in plextrac plextrac. EPSS 0.9% chance of exploitation in the next 30 days.

The PlexTrac platform prior to API version 1.17.0 does not restrict excessive MFA TOTP submission attempts. An unauthenticated remote attacker in possession of a valid username and password can bruteforce their way past MFA protections to login as the targeted user.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 60% of CVEs (scores of 2026-10-31)
CWE: CWE-307
Published: 2022-09-08
Modified: 2026-07-09
Record from: the NVD, synced 2026-10-19

Affected

plextrac:plextrac

References

https://www.controlgap.com/blog/a-plextrac-story
https://www.controlgap.com/blog/a-plextrac-story

Check your stack JSON