CVE-2022-35497

Description

In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reflected cross-site scripting affecting the external document viewer endpoint.

References

• http://tm4web.com
• http://trimble.com
• https://github.com/PN-Tester/CVE-2022-35497/tree/main