CVE-2022-1065 Multi Factor Authentication Bypass in various versions of Abacus ERP
Remote attackers can bypass the second factor of authentication in Abacus ERP, potentially gaining unauthorized access to the system.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-1065?
CVE-2022-1065 is a high-severity authentication bypass vulnerability in Abacus ERP, published on 19 Apr 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability within the authentication process of Abacus ERP allows a remote attacker to bypass the second authentication factor. This issue affects: Abacus ERP v2022 versions prior to R1 of 2022-01-15; v2021 versions prior to R4 of 2022-01-15; v2020 versions prior to R6 of 2022-01-15; v2019 versions later than R5 (service pack); v2018 versions later than R5 (service pack). This issue does not affect: Abacus ERP v2019 versions prior to R5 of 2020-03-15; v2018 versions prior to R7 of 2020-04-15; v2017 version and prior versions and prior versions.
Which versions are affected by CVE-2022-1065?
It affects 5 products.
Products include Abacus Abacus Erp 2018, Abacus Abacus Erp 2019, Abacus Abacus Erp 2020, Abacus Abacus Erp 2021, Abacus Abacus Erp 2022.
How do I fix CVE-2022-1065?
No fix has been published for CVE-2022-1065 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2022-1065 being exploited?
There is no known exploitation of CVE-2022-1065 in the wild and no public exploit code.
Sources
Also known as GHSA-gc8j-wq9j-m4cx.