CVE-2022-1065

Published: Apr 19, 2022Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

A vulnerability within the authentication process of Abacus ERP allows a remote attacker to bypass the second authentication factor. This issue affects: Abacus ERP v2022 versions prior to R1 of 2022-01-15; v2021 versions prior to R4 of 2022-01-15; v2020 versions prior to R6 of 2022-01-15; v2019 versions later than R5 (service pack); v2018 versions later than R5 (service pack). This issue does not affect: Abacus ERP v2019 versions prior to R5 of 2020-03-15; v2018 versions prior to R7 of 2020-04-15; v2017 version and prior versions and prior versions.

Affected (5)

Products: Abacus: Abacus Erp 2018, Abacus Erp 2019, Abacus Erp 2020, Abacus Erp 2021, Abacus Erp 2022

5 products

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Abacus Abacus Erp 2018	From r7
Abacus Abacus Erp 2019	From r5
Abacus Abacus Erp 2020	Before r6
Abacus Abacus Erp 2021	Before r4
Abacus Abacus Erp 2022	Before r1

Related CWEs

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

CWE-304

Missing Critical Step in Authentication

The product implements an authentication technique, but it skips a step that weakens the technique.

References (2)

https://www.redguard.ch/advisories/abacus_mfa_bypass.txt

Source: vulnerability@ncsc.ch

ExploitThird Party Advisory

https://www.redguard.ch/advisories/abacus_mfa_bypass.txt

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.