CVE-2025-41015

Katalog CVE

CVSS 7.5 · High EPSS 0,30%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada tcman gim. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

User Enumeration Vulnerability in TCMAN GIM v11 version 20250304. This vulnerability allows an unauthenticated attacker to determine whether a user exists on the system. The vulnerability is exploitable through the 'pda:username' parameter with 'soapaction GetUserQuestionAndAnswer' in '/WS/PDAWebService.asmx'.

Rincian

Terbit di NVD

2 Desember 2025

Terakhir diubah

25 September 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,30% peluang dieksploitasi; lebih tinggi dari 21,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tcman-gim-2 advisory pihak ketiga