Vulnerability Note VU#595884
Aptexx Resident Anywhere exposes sensitive account information
Aptexx Resident Anywhere does not require authentication to view and modify sensitive information contained in direct account and payment URLs, which can be leveraged to bypass authentication and access user accounts.
CWE-288: Authentication Bypass Using an Alternate Path or Channel - CVE-2014-4882
Aptexx Resident Anywhere, an online payment processing and maintenance request handling service for property managers, does not require authentication to view and modify the account information of its users. Anyone with knowledge of a direct account URL or the ability to guess one can gain account access, bypassing authentication. Account access enables a user to view and modify account data and to submit payments and requests.
A remote, unauthenticated attacker with access to a specific URL can acquire the last four digits of any stored payment account numbers, as well as the name, address, email address, phone number, and payment history of the victim user. The attacker can modify or remove account information, set a new password, and submit fraudulent maintenance requests and payments using stored payment methods.
The CERT/CC is currently unaware of a practical solution to this problem. Until this vulnerability is addressed, Aptexx users should consider the following workaround:
Do not store sensitive information
Vendor Information (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Aptexx||Affected||28 Aug 2014||01 Jul 2015|
CVSS Metrics (Learn More)
Thanks to Claus Jensen for reporting this vulnerability.
This document was written by Todd Lewellen and Joel Land.
- CVE IDs: CVE-2014-4882
- Date Public: 08 Jun 2015
- Date First Published: 08 Jun 2015
- Date Last Updated: 01 Jul 2015
- Document Revision: 35
If you have feedback, comments, or additional information about this vulnerability, please send us email.