A high-severity information exposure vulnerability in TCMAN GIM allows unauthenticated attackers to harvest valid usernames, facilitating further targeted attacks.

This vulnerability involves the improper exposure of sensitive information via the pda:username parameter in the /WS/PDAWebService.asmx endpoint. An unauthenticated attacker can leverage the GetLastDatePasswordChange SOAP action to confirm the existence of specific user accounts on the target system.

The ability for an unauthenticated attacker to enumerate valid usernames significantly lowers the barrier for credential-based attacks, such as password spraying or brute-force attempts. With a CVSS score of 7.5, this flaw represents a significant risk to organizational identity security and increases the likelihood of unauthorized account access, potentially leading to broader data compromise.

Immediate Action: Update the TCMAN GIM software to version 20250401 or later to implement the vendor-provided fix.

Proactive Monitoring: Review web server access logs for anomalous traffic patterns directed at the /WS/PDAWebService.asmx endpoint, specifically monitoring for frequent requests containing the GetLastDatePasswordChange action.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block or rate-limit requests to the PDAWebService endpoint, specifically filtering for the identified SOAP action from untrusted sources.

Public Exploit Available: exploit_available (unknown)

This vulnerability presents a clear risk by providing attackers with the intelligence required to conduct more sophisticated identity-based attacks. Organizations utilizing TCMAN GIM must prioritize updating to version 20250401 immediately to close this enumeration vector and prevent the identification of internal user accounts by unauthorized actors.