CVE-2022-1065

Multi Factor Authentication Bypass in various versions of Abacus ERP

HIGH

8.8

CVSS Score

Published: April 19, 2022 at 07:50 AM UTC

Updated: June 17, 2026 at 04:21 AM UTC

6 products affected across 2 vendorsAbacus ERP 2020Abacus ERP 2021Abacus ERP 2022

Using Abacus ERP by Abacus Research AG?

Get instant alerts when new vulnerabilities affect Abacus ERP - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.8

Exploit prediction

EPSS 3%

Description

A vulnerability within the authentication process of Abacus ERP allows a remote attacker to bypass the second authentication factor. This issue affects: Abacus ERP v2022 versions prior to R1 of 2022-01-15; v2021 versions prior to R4 of 2022-01-15; v2020 versions prior to R6 of 2022-01-15; v2019 versions later than R5 (service pack); v2018 versions later than R5 (service pack). This issue does not affect: Abacus ERP v2019 versions prior to R5 of 2020-03-15; v2018 versions prior to R7 of 2020-04-15; v2017 version and prior versions and prior versions.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Abacus ERP 2018 · Abacus

95%

v ≥ r7

Abacus ERP 2019 · Abacus

95%

v ≥ r5

Abacus ERP 2020 · Abacus

95%

v < r6

Affected range stops below r6, so it looks safe — our inference, not a vendor statement

Abacus ERP 2021 · Abacus

95%

v < r4

Affected range stops below r4, so it looks safe — our inference, not a vendor statement

Abacus ERP 2022 · Abacus

95%

v < r1

Affected range stops below r1, so it looks safe — our inference, not a vendor statement

Abacus ERP · Abacus Research

60%

R5 (service pack) ≤ v < v2018*R5 (service pack) ≤ v < v2019*v2020 ≤ v < R6 of 2022-01-15v2021 ≤ v < R4 of 2022-01-15v2022 ≤ v < R1 of 2022-01-152020 2021 2022 R5 (service pack)

Affected range stops below R1 of 2022-01-15, so it looks safe — our inference, not a vendor statement

Affected range stops below R4 of 2022-01-15, so it looks safe — our inference, not a vendor statement

Affected range stops below R6 of 2022-01-15, so it looks safe — our inference, not a vendor statement

Vendor states this is fixed in v2017 (unaffected)

Affected range stops below v2018*, so it looks safe — our inference, not a vendor statement

Affected range stops below v2019*, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (1)

x_refsource_CONFIRMExploitThird Party Advisory

Source: [email protected]

https://www.redguard.ch/advisories/abacus_mfa_bypass.txt

CVSS

8.8HIGH[email protected]

Attack Vector: NETWORK
Complexity: LOW
Privileges: LOW
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: HIGH
Integrity: HIGH
Availability: HIGH

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-304CWE-287

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card