SB2022091206 - Multiple vulnerabilities in PlexTrac

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Improper Restriction of Excessive Authentication Attempts (CVE-ID: CVE-2022-37145)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to improper restriction of excessive authentication attempts in the login page. A remote attacker can perform a brute-force attack and gain access to sensitive information.

2) Improper Restriction of Excessive Authentication Attempts (CVE-ID: CVE-2022-37144)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to improper restriction of excessive authentication attempts in the MFA TOTP implementation. A remote attacker can perform a brute-force attack and bypass multifactor authentication.

Remediation

Install update from vendor's website.

References

• http://plextrac.com
• https://www.controlgap.com/blog/a-plextrac-story