GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2022-1065

Vulnerability from fkie_nvd - Published: 2022-04-19 08:15 - Updated: 2026-06-17 04:21
Severity
8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
A vulnerability within the authentication process of Abacus ERP allows a remote attacker to bypass the second authentication factor. This issue affects: Abacus ERP v2022 versions prior to R1 of 2022-01-15; v2021 versions prior to R4 of 2022-01-15; v2020 versions prior to R6 of 2022-01-15; v2019 versions later than R5 (service pack); v2018 versions later than R5 (service pack). This issue does not affect: Abacus ERP v2019 versions prior to R5 of 2020-03-15; v2018 versions prior to R7 of 2020-04-15; v2017 version and prior versions and prior versions.
References
vulnerability@ncsc.chhttps://www.redguard.ch/advisories/abacus_mfa_bypass.txtExploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.redguard.ch/advisories/abacus_mfa_bypass.txtExploit, Third Party Advisory
Impacted products
Vendor Product Version
abacus abacus_erp_2018 *
abacus abacus_erp_2019 *
abacus abacus_erp_2020 *
abacus abacus_erp_2021 *
abacus abacus_erp_2022 *
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "Abacus ERP",
          "vendor": "Abacus Research AG",
          "versions": [
            {
              "lessThan": "R1 of 2022-01-15",
              "status": "affected",
              "version": "v2022",
              "versionType": "custom"
            },
            {
              "lessThan": "R4 of 2022-01-15",
              "status": "affected",
              "version": "v2021",
              "versionType": "custom"
            },
            {
              "lessThan": "R6 of 2022-01-15",
              "status": "affected",
              "version": "v2020",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "R5 of 2020-03-15",
                  "status": "affected"
                }
              ],
              "lessThan": "v2019*",
              "status": "affected",
              "version": "R5 (service pack)",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "R7 of 2020-04-15",
                  "status": "affected"
                }
              ],
              "lessThan": "v2018*",
              "status": "affected",
              "version": "R5 (service pack)",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "and prior versions",
              "status": "unaffected",
              "version": "v2017",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "vulnerability@ncsc.ch"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:abacus:abacus_erp_2018:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0E6374E0-5722-4E67-8D3D-7064972155DF",
              "versionStartIncluding": "r7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:abacus:abacus_erp_2019:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "EE33C1DA-93EA-4EF0-A997-73065915A281",
              "versionStartIncluding": "r5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:abacus:abacus_erp_2020:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "5661E368-AF11-4AC0-9169-D1C5BBD698AC",
              "versionEndExcluding": "r6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:abacus:abacus_erp_2021:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C33CFF07-8293-4A50-9877-2521D655725D",
              "versionEndExcluding": "r4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:abacus:abacus_erp_2022:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "3E9364AB-33D8-43C2-8202-4562DC60F069",
              "versionEndExcluding": "r1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability within the authentication process of Abacus ERP allows a remote attacker to bypass the second authentication factor. This issue affects: Abacus ERP v2022 versions prior to R1 of 2022-01-15; v2021 versions prior to R4 of 2022-01-15; v2020 versions prior to R6 of 2022-01-15; v2019 versions later than R5 (service pack); v2018 versions later than R5 (service pack). This issue does not affect: Abacus ERP v2019 versions prior to R5 of 2020-03-15; v2018 versions prior to R7 of 2020-04-15; v2017 version and prior versions and prior versions."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en el proceso de autenticaci\u00f3n de Abacus ERP permite a un atacante remoto omitir el segundo factor de autenticaci\u00f3n. Este problema afecta a: Abacus ERP v2022 versiones anteriores a R1 de 15-01-2022; v2021 versiones anteriores a R4 de 15-01-2022; v2020 versiones anteriores a R6 de 15-01-2022; v2019 versiones posteriores a R5 (service pack); v2018 versiones posteriores a R5 (service pack). Este problema no afecta a: Abacus ERP v2019 versiones anteriores a R5 de 15-03-2020; v2018 versiones anteriores a R7 de 15-04-2020; v2017 versi\u00f3n y versiones anteriores y versiones anteriores"
    }
  ],
  "id": "CVE-2022-1065",
  "lastModified": "2026-06-17T04:21:45.597",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 9.0,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2,
        "source": "vulnerability@ncsc.ch",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-04-19T08:15:06.810",
  "references": [
    {
      "source": "vulnerability@ncsc.ch",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://www.redguard.ch/advisories/abacus_mfa_bypass.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://www.redguard.ch/advisories/abacus_mfa_bypass.txt"
    }
  ],
  "sourceIdentifier": "vulnerability@ncsc.ch",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-304"
        }
      ],
      "source": "vulnerability@ncsc.ch",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.