CASE PM-82845-19-202131

Adjustments are made to the web console access recovery logic for Aranda PassRecovery (APRUSERS). From this improvement, the behavior of access to the console is changed, sending an email with an access token. Regardless of whether the entered user exists or not, the following message will be displayed:

“If the information is correct, an email will be sent with instructions.”

The email will be sent only if the user exists in the system. Otherwise, no additional information will be disclosed, thus mitigating the risk of user enumeration.

📄 See the documentation on the new behavior

⚐ NOTES OR ADDITIONAL INSTRUCTIONS

• Run the “Aranda.PassRecovery.Installer.exe” file and follow the instructions in the installer.
  
• The executable file functions as both an installer and an update tool.
  
• This update applies only to databases in version 8.0.171.