CVE-2025-40668CWE-863

Incorrect Authorization vulnerability in TCMAN GIM

High · published June 9, 2025

CVSS v4.0
7.1
EPSS
0%
Percentile
18.7
In the wild
Unconfirmed
What it is

Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an attacker, with low privilege level, to change the password of other users through a POST request using the parameters idUser, PasswordActual, PasswordNew and PasswordNewRepeat in /PC/WebService.aspx/validateChangePassword%C3%B1a. To exploit the vulnerability the PasswordActual parameter must be empty.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00273 · 18.7th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2025-06-09T12:25Z
EPSS history
Timeline
  • 09 JUN 12:25Z
    Incorrect Authorization vulnerability in TCMAN GIM
    cvelistv5