title: Multi Factor Authentication Bypass in various versions of Abacus ERP
description: A vulnerability within the authentication process of Abacus ERP allows a remote attacker to bypass the second authentication factor. This issue affects: Abacus ERP v2022 versions prior to R1 of 2022-01-15; v2021 versions prior to R4 of 2022-01-15; v2020 versions prior to R6 of 2022-01-15; v2019 versions later than R5 (service pack); v2018 versions later than R5 (service pack). This issue does not affect: Abacus ERP v2019 versions prior to R5 of 2020-03-15; v2018 versions prior to R7 of 2020-04-15; v2017 version and prior versions and prior versions.
problem types: CWE-304 Missing Critical Step in Authentication
affected:
{
product: Abacus ERP
vendor: Abacus Research AG
versions:
lessThan: R1 of 2022-01-15, status: affected, version: v2022, versionType: custom
lessThan: R4 of 2022-01-15, status: affected, version: v2021, versionType: custom
lessThan: R6 of 2022-01-15, status: affected, version: v2020, versionType: custom
changes: [at: R5 of 2020-03-15, status: affected], lessThan: v2019*, status: affected, version: R5 (service pack), versionType: custom
changes: [at: R7 of 2020-04-15, status: affected], lessThan: v2018*, status: affected, version: R5 (service pack), versionType: custom
lessThanOrEqual: and prior versions, status: unaffected, version: v2017, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
version: 3.1
]
solutions: Install the available hot fixes and / or service packs from 2022-01-15 or newer