Abacus ERP: Improper Authentication
CVE-2022-1065 is a high-severity improper authentication vulnerability in Abacus ERP from Abacus Research, with a CVSS 3.1 base score of 8.8 out of 10. It can be exploited remotely over the network by an attacker with a low-privileged account, without any action from a user. The record lists versions R1 of 2022-01-15, R4 of 2022-01-15, R6 of 2022-01-15 as the first without the flaw, so updating Abacus ERP to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 2.89% chance of exploitation within 30 days, higher than 87% of scored CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Abacus ERP to R1 of 2022-01-15 or R4 of 2022-01-15 or R6 of 2022-01-15 or v2019*, whichever matches your release line, or a later version.
- Update Abacus ERP 2020 to r6 or a later version.
- Update Abacus ERP 2021 to r4 or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Abacus Research | Abacus ERP | v2022 up to, but not including, R1 of 2022-01-15; v2021 up to, but not including, R4 of 2022-01-15; v2020 up to, but not including, R6 of 2022-01-15; R5 (service pack) up to, but not including, v2019*; R5 (service pack) up to, but not including, v2018* | R1 of 2022-01-15, R4 of 2022-01-15, R6 of 2022-01-15, v2019*, v2018* |
| Abacus | Abacus ERP 2018 | r7 and later | Not stated |
| Abacus | Abacus ERP 2019 | r5 and later | Not stated |
| Abacus | Abacus ERP 2020 | before r6 | r6 |
| Abacus | Abacus ERP 2021 | before r4 | r4 |
| Abacus | Abacus ERP 2022 | before r1 | r1 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 8.1 | High | CNA (ncsc.ch) |
| CVSS 3.1 | 8.8 | High | NVD |
| CVSS 2.0 | 9.0 | High | NVD |
Official description
A vulnerability within the authentication process of Abacus ERP allows a remote attacker to bypass the second authentication factor. This issue affects: Abacus ERP v2022 versions prior to R1 of 2022-01-15; v2021 versions prior to R4 of 2022-01-15; v2020 versions prior to R6 of 2022-01-15; v2019 versions later than R5 (service pack); v2018 versions later than R5 (service pack). This issue does not affect: Abacus ERP v2019 versions prior to R5 of 2020-03-15; v2018 versions prior to R7 of 2020-04-15; v2017 version and prior versions and prior versions.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
How developers prevent this class of flaw
- Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
Timeline
- CVE record published.
- Record last changed materially (score, affected products, status or references).
References
Technical write-ups (may include proof of concept)
- redguard.ch/advisories/abacus_mfa_bypass.txtExploit, Third Party Advisory
Recent Improper Authentication vulnerabilities
- 8.8 High severity
- 10.0 Critical severity
- 9.1 Critical severity
- 9.8 Critical severity
- 8.1 High severity
- 9.1 Critical severity
Spotted an error? Tell us.