CVE-2025-40667: falha de alta gravidade em TCMAN GIM
Missing authorization vulnerability in TCMAN GIM v11
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.7epss 0.3%
Missing authorization vulnerability in TCMAN's GIM v11. This allows an authenticated attacker to access any functionality of the application even when they are not available through the user interface. To exploit the vulnerability the attacker must modify the HTTP code of the response from ‘302 Found’ to ‘200 OK’, as well as the hidden fields hdnReadOnly and hdnUserLogin.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Produtos afetados
TCMAN · GIMCVEs relacionadas — TCMAN GIM
No mesmo produto, das mais perigosas para as menos.
CVE-2021-40851HIGHTCMAN GIM SQL injection vulnerabilityEPSS 1.4%CVE-2021-40850CRITICALTCMAN GIM SQL injection vulnerabilityEPSS 1.0%CVE-2021-40853HIGHTCMAN GIM missing authorization vulnerabilityEPSS 0.9%CVE-2022-36276CRITICALSQL injection vulnerability in TCMAN GIMEPSS 0.8%CVE-2025-40625CRITICALMultiple vulnerabilities in TCMAN's GIMEPSS 0.8%CVE-2021-40852MEDIUMTCMAN GIM open redirect vulnerabilityEPSS 0.7%