CVE-2021-40853 TCMAN GIM missing authorization vulnerability
Remote attackers can access privileged resources without authorization, potentially exposing sensitive information in TCMAN GIM.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-40853?
CVE-2021-40853 is a high-severity missing authorization vulnerability in TCMAN GIM, published on 17 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
TCMAN GIM does not perform an authorization check when trying to access determined resources. A remote attacker could exploit this vulnerability to access URL that require privileges without having them. The exploitation of this vulnerability might allow a remote attacker to obtain sensible information.
Weakness: CWE-862
Which versions are affected by CVE-2021-40853?
It affects 1 product.
Products include Tcman Gim.
How do I fix CVE-2021-40853?
No fix has been published for CVE-2021-40853 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-40853 being exploited?
There is no known exploitation of CVE-2021-40853 in the wild and no public exploit code.
Other vulnerabilities in TCMAN GIM
Sources
Also known as GHSA-g4wc-2gqq-5g7v.