CVE-2022-1065
Published Apr 19, 2022
Last updated 3 years ago
Overview
- Description
- A vulnerability within the authentication process of Abacus ERP allows a remote attacker to bypass the second authentication factor. This issue affects: Abacus ERP v2022 versions prior to R1 of 2022-01-15; v2021 versions prior to R4 of 2022-01-15; v2020 versions prior to R6 of 2022-01-15; v2019 versions later than R5 (service pack); v2018 versions later than R5 (service pack). This issue does not affect: Abacus ERP v2019 versions prior to R5 of 2020-03-15; v2018 versions prior to R7 of 2020-04-15; v2017 version and prior versions and prior versions.
- Source
- vulnerability@ncsc.ch
- NVD status
- Analyzed
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 8.8
- Impact score
- 5.9
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity
- HIGH
CVSS 2.0
- Type
- Primary
- Base score
- 9
- Impact score
- 10
- Exploitability score
- 8
- Vector string
- AV:N/AC:L/Au:S/C:C/I:C/A:C
Social media
- Hype score
- Not currently trending
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:abacus:abacus_erp_2018:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0E6374E0-5722-4E67-8D3D-7064972155DF",
"versionStartIncluding": "r7"
},
{
"criteria": "cpe:2.3:a:abacus:abacus_erp_2019:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EE33C1DA-93EA-4EF0-A997-73065915A281",
"versionStartIncluding": "r5"
},
{
"criteria": "cpe:2.3:a:abacus:abacus_erp_2020:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5661E368-AF11-4AC0-9169-D1C5BBD698AC",
"versionEndExcluding": "r6"
},
{
"criteria": "cpe:2.3:a:abacus:abacus_erp_2021:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C33CFF07-8293-4A50-9877-2521D655725D",
"versionEndExcluding": "r4"
},
{
"criteria": "cpe:2.3:a:abacus:abacus_erp_2022:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3E9364AB-33D8-43C2-8202-4562DC60F069",
"versionEndExcluding": "r1"
}
],
"operator": "OR"
}
]
}
]