Read the docs
TI-2022-17310 Aliases CVE-2022-37145GHSA-9825-85h5-5w5p

The PlexTrac platform prior to version 1.17.0 does not restrict excessive authentication…

Priority LOW 35CWE-307Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-307.

Summary

The PlexTrac platform prior to version 1.17.0 does not restrict excessive authentication attempts for accounts configured to use the PlexTrac authentication provider. An unauthenticated remote attacker could perform a bruteforce attack on the login page with no time or attempt limitation in an attempt to obtain valid credentials for the platform users configured to use the PlexTrac authentication provider.

Why it matters now

EPSS 0.01049 64th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:plextrac:plextrac:*:*:*:*:*:*:*:*before 1.17.0VulnerablePlexTrac
  • cpe:2.3:a:plextrac:plextrac:*:*:*:*:*:*:*:* Versions before 1.17.0 Vulnerable ·PlexTrac

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-37145
  2. 2026-10-03 Alias added: GHSA-9825-85h5-5w5p

References

Advisory 1

  • TI-2024-10978 Arbitrary File Write via PTRAC Import CVSS 4.0HIGH 8.9
  • TI-2024-10977 Arbitrary Directory Write via Runbooks Artifact Upload CVSS 4.0HIGH 8.9
  • TI-2024-11766 Insecure YAML Deserialization CVSS 4.0HIGH 8.6
  • TI-2024-10982 Local File Inclusion CVSS 4.0HIGH 8.6
  • TI-2024-10981 N1QL Injection CVSS 4.0HIGH 8.6
  • TI-2022-17309 The PlexTrac platform prior to API version 1.17.0 does not restrict excessive MFA TOTP… CVSS 3.1HIGH 8.8
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences