Session Identifier Vulnerability in Trimble TM4WEB Product
CVE-2022-35497

5.4MEDIUM

Key Information:

Vendor

Trimble

Status
TM4WEB
Vendor
CVE Published:
4 September 2026

What is CVE-2022-35497?

The vulnerability in Trimble TM4WEB version 21.4.0.4 arises from a security misconfiguration regarding session identifiers. This flaw allows for the potential retrieval of valid session cookies through reflected cross-site scripting, particularly at the external document viewer endpoint. Attackers exploiting this vulnerability can gain unauthorized access, impacting the confidentiality and integrity of user sessions.

References

http://tm4web.com
http://trimble.com
https://github.com/PN-Tester/CVE-2022-35497/tree/main

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.