CWE-288: Authentication Bypass Using an Alternate Path or Channel - CVE-2014-4882

Aptexx Resident Anywhere, an online payment processing and maintenance request handling service for property managers, does not require authentication to view and modify the account information of its users. Anyone with knowledge of a direct account URL or the ability to guess one can gain account access, bypassing authentication. Account access enables a user to view and modify account data and to submit payments and requests.

A remote, unauthenticated attacker with access to a specific URL can acquire the last four digits of any stored payment account numbers, as well as the name, address, email address, phone number, and payment history of the victim user. The attacker can modify or remove account information, set a new password, and submit fraudulent maintenance requests and payments using stored payment methods.

The CERT/CC is currently unaware of a practical solution to this problem. Until this vulnerability is addressed, Aptexx users should consider the following workaround:

Do not store sensitive information

Do not store sensitive information, specifically payment (credit/debit card or bank account) information with Aptexx until this vulnerability has been resolved. Current users should consider removing sensitive information from their Aptexx accounts.