CVE-2022-1065

Multi Factor Authentication Bypass in various versions of Abacus ERP

High8.1EPSS 2.9%

Published: 19 Apr 2022
Updated: 2 Aug 2024
Reserved: 24 Mar 2022
Assigned by: NCSC.ch

Description

A vulnerability within the authentication process of Abacus ERP allows a remote attacker to bypass the second authentication factor. This issue affects: Abacus ERP v2022 versions prior to R1 of 2022-01-15; v2021 versions prior to R4 of 2022-01-15; v2020 versions prior to R6 of 2022-01-15; v2019 versions later than R5 (service pack); v2018 versions later than R5 (service pack). This issue does not affect: Abacus ERP v2019 versions prior to R5 of 2020-03-15; v2018 versions prior to R7 of 2020-04-15; v2017 version and prior versions and prior versions.

Scores

CVSS scores of CVE-2022-1065, by who scored it
Scored by	CVSS	Score	Vector
NCSC.chCNA (assigner)	3.1	High8.1	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
NVDNVD · Modified	3.1	High8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS (exploitation in 30 days): 2.9% · top 13% of all CVEs (6 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.1.

Weakness

Affected products

Abacus Research AG · Abacus ERP
- affected v2022 – < R1 of 2022-01-15
- affected v2021 – < R4 of 2022-01-15
- affected v2020 – < R6 of 2022-01-15
- affected R5 (service pack) – < v2019*
- affected R5 (service pack) – < v2018*
- unaffected v2017 – ≤ and prior versions

What to do

Solution: Install the available hot fixes and / or service packs from 2022-01-15 or newer

References (1)

https://www.redguard.ch/advisories/abacus_mfa_bypass.txt (opens in a new tab)x_refsource_CONFIRMx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2022-1065](https://trackcve.app/badge/CVE-2022-1065.svg)](https://trackcve.app/cve/CVE-2022-1065)

Record last updated 2 Aug 2024, 23:47 UTC.