{"id":"CVE-2022-1065","aliases":["EUVD-2022-24409","GHSA-gc8j-wq9j-m4cx"],"status":"published","title":"Multi Factor Authentication Bypass in various versions of Abacus ERP","description":"A vulnerability within the authentication process of Abacus ERP allows a remote attacker to bypass the second authentication factor. This issue affects: Abacus ERP v2022 versions prior to R1 of 2022-01-15; v2021 versions prior to R4 of 2022-01-15; v2020 versions prior to R6 of 2022-01-15; v2019 versions later than R5 (service pack); v2018 versions later than R5 (service pack). This issue does not affect: Abacus ERP v2019 versions prior to R5 of 2020-03-15; v2018 versions prior to R7 of 2020-04-15; v2017 version and prior versions and prior versions.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.02885,"percentile":0.8697,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-287","CWE-304"],"published":"2022-04-19T07:50:10Z","modified":"2026-06-17T04:21:45Z","products":[{"vendor":"abacus","product":"abacus_erp_2018"},{"vendor":"abacus","product":"abacus_erp_2019"},{"vendor":"abacus","product":"abacus_erp_2020"},{"vendor":"abacus","product":"abacus_erp_2021"},{"vendor":"abacus","product":"abacus_erp_2022"},{"vendor":"abacus research ag","product":"abacus erp"}],"references":[{"url":"https://www.redguard.ch/advisories/abacus_mfa_bypass.txt","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1065"},{"url":"https://github.com/advisories/GHSA-gc8j-wq9j-m4cx"}],"sources":{"cve":[{"id":"CVE-2022-1065","title":"Multi Factor Authentication Bypass in various versions of Abacus ERP","description":"A vulnerability within the authentication process of Abacus ERP allows a remote attacker to bypass the second authentication factor. This issue affects: Abacus ERP v2022 versions prior to R1 of 2022-01-15; v2021 versions prior to R4 of 2022-01-15; v2020 versions prior to R6 of 2022-01-15; v2019 versions later than R5 (service pack); v2018 versions later than R5 (service pack). This issue does not affect: Abacus ERP v2019 versions prior to R5 of 2020-03-15; v2018 versions prior to R7 of 2020-04-15; v2017 version and prior versions and prior versions.","status":"published","published":"2022-04-19T07:50:10Z","modified":"2024-08-02T23:47:43.377Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-304"],"updated_at":"2026-11-02T14:34:38.581997Z"}],"euvd":[{"id":"EUVD-2022-24409","description":"A vulnerability within the authentication process of Abacus ERP allows a remote attacker to bypass the second authentication factor. This issue affects: Abacus ERP v2022 versions prior to R1 of 2022-01-15; v2021 versions prior to R4 of 2022-01-15; v2020 versions prior to R6 of 2022-01-15; v2019 versions later than R5 (service pack); v2018 versions later than R5 (service pack). This issue does not affect: Abacus ERP v2019 versions prior to R5 of 2020-03-15; v2018 versions prior to R7 of 2020-04-15; v2017 version and prior versions and prior versions.","status":"published","published":"2022-04-19T07:50:10Z","modified":"2024-08-02T23:47:43Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T03:26:02.561344Z"}],"ghsa":[{"id":"GHSA-gc8j-wq9j-m4cx","title":"A vulnerability within the authentication process of Abacus ERP allows a remote attacker to...","description":"A vulnerability within the authentication process of Abacus ERP allows a remote attacker to bypass the second authentication factor. This issue affects: Abacus ERP v2022 versions prior to R1 of 2022-01-15; v2021 versions prior to R4 of 2022-01-15; v2020 versions prior to R6 of 2022-01-15; v2019 versions later than R5 (service pack); v2018 versions later than R5 (service pack). This issue does not affect: Abacus ERP v2019 versions prior to R5 of 2020-03-15; v2018 versions prior to R7 of 2020-04-15; v2017 version and prior versions and prior versions.","status":"published","published":"2022-04-20T00:00:34Z","modified":"2023-01-27T05:01:45Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:41:57.859539Z"}],"nvd":[{"id":"CVE-2022-1065","description":"A vulnerability within the authentication process of Abacus ERP allows a remote attacker to bypass the second authentication factor. This issue affects: Abacus ERP v2022 versions prior to R1 of 2022-01-15; v2021 versions prior to R4 of 2022-01-15; v2020 versions prior to R6 of 2022-01-15; v2019 versions later than R5 (service pack); v2018 versions later than R5 (service pack). This issue does not affect: Abacus ERP v2019 versions prior to R5 of 2020-03-15; v2018 versions prior to R7 of 2020-04-15; v2017 version and prior versions and prior versions.","status":"published","published":"2022-04-19T08:15:06.81Z","modified":"2026-06-17T04:21:45.597Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9,"vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-304","CWE-287"],"updated_at":"2026-11-02T14:07:16.9948Z"}]}}