PT-2025-24430 · Tcman · Tcman'S Gim
CVE-2025-40670
·
Publicado
2025-06-09
·
Atualizado
2025-06-09
CVSS v3.1
8.8
Alta
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
TCMAN's GIM version 11
Description
The issue is related to an incorrect authorization vulnerability. This vulnerability allows an unprivileged attacker to create a user and assign it many privileges by sending a POST request to "/PC/frmGestionUser.aspx/updateUser".
Recommendations
For TCMAN's GIM version 11, consider restricting access to the "/PC/frmGestionUser.aspx/updateUser" endpoint to prevent unauthorized user creation and privilege assignment until a patch is available.
Correção
LPE
Incorrect Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Tcman'S Gim