Log in Start free

Vulnerability · Published Apr 19, 2022 · Assigned by NCSC.ch

CVE-2022-1065Multi Factor Authentication Bypass in various versions of Abacus ERP

High 8.1

In plain English

A high-severity security flaw in Abacus ERP from Abacus Research AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.9% (higher than 87% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)2.9%top 13.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A vulnerability within the authentication process of Abacus ERP allows a remote attacker to bypass the second authentication factor. This issue affects: Abacus ERP v2022 versions prior to R1 of 2022-01-15; v2021 versions prior to R4 of 2022-01-15; v2020 versions prior to R6 of 2022-01-15; v2019 versions later than R5 (service pack); v2018 versions later than R5 (service pack). This issue does not affect: Abacus ERP v2019 versions prior to R5 of 2020-03-15; v2018 versions prior to R7 of 2020-04-15; v2017 version and prior versions and prior versions.

Affected products (as reported)

VendorProductVersions
Abacus Research AG Abacus ERP v2022 – before R1 of 2022-01-15v2021 – before R4 of 2022-01-15v2020 – before R6 of 2022-01-15R5 (service pack) – before v2019*R5 (service pack) – before v2018*

Weakness: CWE-304 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References