CVE-2022-35497

MediumCVSS 5.4

Published: 04/09/2026(UTC)Updated: 14/09/2026(UTC)Translated: 04/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

18th percentile - higher than 18% of all known CVEs

Summary

In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reflected cross-site scripting affecting the external document viewer endpoint.

Risk Assessment

An attacker can hijack a user's session, potentially leading to unauthorized access to data and system functions.

Recommendation

Update Trimble TM4WEB and improve session configuration, including using secure cookie flags and XSS protections.

Other vulnerabilities in Trimble TM4WEB

CVE-2022-35499High
In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injection in an arbitrary parameter appended to the URL.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS