High · published December 2, 2025
⚠️ An attacker can easily check if a user exists on the system, all thanks to a sneaky parameter in TCMAN GIM! This means anyone with access can snoop around without breaking a sweat. 🔍 Think of it like a library where you can ask if someone has a membership without ever showing your own ID. The librarian can simply tell you if that person is in the system — super easy, right? With this user enumeration vulnerability, an attacker could identify valid usernames, enabling them to target specific accounts for further attacks like password guessing or phishing. It’s like handing out a scorecard of potential victims—definitely not a friendly move!
Think of it like a library where you can ask if someone has a membership without ever showing your own ID. The librarian can simply tell you if that person is in the system — super easy, right? This vulnerability arises from the 'pda:username' parameter used in the 'soapaction GetLastDatePasswordChange' call within the '/WS/PDAWebService.asmx' endpoint, allowing unauthenticated users to query the existence of specific usernames.
With this user enumeration vulnerability, an attacker could identify valid usernames, enabling them to target specific accounts for further attacks like password guessing or phishing. It’s like handing out a scorecard of potential victims—definitely not a friendly move! To secure your system, update TCMAN GIM to version 20250305 or later. Additionally, consider implementing rate limiting and error handling to obscure user existence feedback. It's time to tighten those security loose ends! 💪 You’ve got this! By following these steps, you’ll patch up that vulnerability in no time and strengthen your defenses! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| tcman/gim | < 2025-04-01 | 2025-04-01 |