TCMAN GIM Password Change Authorization Vulnerability

An incorrect authorization vulnerability has been identified in TCMAN's GIM version 11. This vulnerability allows an attacker with low privileges to change the passwords of other users. The exploitation involves sending a POST request to '/PC/WebService.aspx/validateChangePasswordña' with the parameters 'idUser', 'PasswordActual', 'PasswordNew', and 'PasswordNewRepeat'. Notably, the 'PasswordActual' parameter must be left empty to successfully exploit this vulnerability.

Impact

Exploitation of this vulnerability allows for unauthorized password changes, potentially leading to account takeover.

Remediation

Users are advised to update to the latest version of TCMAN GIM Web, version 20250128, where this vulnerability has been fixed.