Vulnerability Note VU#595884
Aptexx Resident Anywhere exposes sensitive account information
Original Release date: 08 Jun 2015 | Last revised: 08 Jun 2015
Aptexx Resident Anywhere does not require authentication to view and modify sensitive information contained in direct account and payment URLs, which can be leveraged to bypass authentication and access user accounts.
CWE-288: Authentication Bypass Using an Alternate Path or Channel – CVE-2014-4882
Aptexx Resident Anywhere, an online payment processing and maintenance request handling service for property managers, does not require authentication to view and modify the account information of its users. Anyone with knowledge of a direct account URL or the ability to guess one can gain account access, bypassing authentication. Account access enables a user to view and modify account data and to submit payments and requests.
A remote, unauthenticated attacker with access to a specific URL can acquire the last four digits of any stored payment account numbers, as well as the name, address, email address, phone number, and payment history of the victim user. The attacker can modify or remove account information, set a new password, and submit fraudulent maintenance requests and payments using stored payment methods.
The CERT/CC is currently unaware of a practical solution to this problem. Until this vulnerability is addressed, Aptexx users should consider the following workaround:
Do not store sensitive information
Do not store sensitive information, specifically payment (credit/debit card or bank account) information with Aptexx until this vulnerability has been resolved. Current users should consider removing sensitive information from their Aptexx accounts.
Vendor Information (Learn More)
VendorStatusDate NotifiedDate UpdatedAptexxAffected28 Aug 201402 Jun 2015If you are a vendor and your product is affected, let
CVSS Metrics (Learn More)
Thanks to Claus Jensen for reporting this vulnerability.
This document was written by Todd Lewellen and Joel Land.
08 Jun 2015
Date First Published:
08 Jun 2015
Date Last Updated:
08 Jun 2015
FeedbackIf you have feedback, comments, or additional information about this vulnerability, please send us email.