CVE-2022-1065

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability within the authentication process of Abacus ERP allows a remote attacker to bypass the second authentication factor. This issue affects: Abacus ERP v2022 versions prior to R1 of 2022-01-15; v2021 versions prior to R4 of 2022-01-15; v2020 versions prior to R6 of 2022-01-15; v2019 versions later than R5 (service pack); v2018 versions later than R5 (service pack). This issue does not affect: Abacus ERP v2019 versions prior to R5 of 2020-03-15; v2018 versions prior to R7 of 2020-04-15; v2017 version and prior versions and prior versions.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-304 CWE-287

Affected software

Vendor	Product	Versions
Abacus Research AG	Abacus ERP	>= v2022, < R1 of 2022-01-15; >= v2021, < R4 of 2022-01-15; >= v2020, < R6 of 2022-01-15; >= R5 (service pack), < v2019; >= R5 (service pack), < v2018

References

https://www.redguard.ch/advisories/abacus_mfa_bypass.txtExploit, Third Party Advisory
https://www.redguard.ch/advisories/abacus_mfa_bypass.txtExploit, Third Party Advisory

Timeline

Published: Apr 19, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-10668.2Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user crede CVE-2022-10676.5Navigating to a specific URL with a patient ID number will result in the server generating a PDF of a lab report without authentication and CVE-2022-10687.5Modbus Tools Modbus Slave (versions 7.4.2 and prior) is vulnerable to a stack-based buffer overflow in the registration field. This may caus CVE-2022-10697.5A crafted HTTP packet with a large content-length header can create a denial-of-service condition in Softing Secure Integration Server V1.22 CVE-2022-10708.1Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user crede CVE-2022-10718.2User after free in mrb_vm_exec in GitHub repository mruby/mruby prior to 3.2.CVE-2022-10739.8A vulnerability was found in Automatic Question Paper Generator 1.0. It has been declared as critical. An attack leads to privilege escalati CVE-2022-10745.4A vulnerability has been found in TEM FLEX-1085 1.6.0 and classified as problematic. Using the input <h1>HTML Injection</h1> in the WiFi set CVE-2022-10755.4A vulnerability was found in College Website Management System 1.0 and classified as problematic. Affected by this issue is the file /cwms/c CVE-2022-10766.1A vulnerability was found in Automatic Question Paper Generator System 1.0. It has been classified as problematic. This affects the file /aq CVE-2022-10777.5A vulnerability was found in TEM FLEX-1080 and FLEX-1085 1.6.0. It has been declared as problematic. This vulnerability log.cgi of the compo CVE-2022-10789.8A vulnerability was found in SourceCodester College Website Management System 1.0. It has been classified as critical. Affected is the file