CVE-2022-37145

The PlexTrac platform prior to version 1.17.0 does not restrict excessive authentication attempts for accounts configured to use the PlexTrac authentication provider. An unauthenticated remote attacker could perform a bruteforce attack on the login page with no time or attempt limitation in an...

CVE-2022-37146

The PlexTrac platform prior to version 1.28.0 allows for username enumeration via HTTP response times on invalid login attempts for users configured to use the PlexTrac authentication provider. Login attempts for valid, unlocked users configured to use PlexTrac as their authentication provider ta...

PT-2022-23838 · Plextrac · Plextrac

Name of the Vulnerable Software and Affected Versions: PlexTrac versions prior to 1.28.0 Description: The issue allows for username enumeration via HTTP response times on invalid login attempts for users configured to use the PlexTrac authentication provider. An unauthenticated remote attacker ca...