VulnerabilityDeferred
CVE-2022-35497
In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reflected cross-site scripting affecting the external document viewer endpoint.
UnscoredEPSS 0.26%
Does this matter?
Not yet scored. NVD analysis is pending; check back once CVSS and EPSS values are published.
Description
In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reflected cross-site scripting affecting the external document viewer endpoint.
- CVSS
- Not yet scored
- EPSS
- 0.26% probability · 18th percentile
- CISA KEV
- Not listed
- Source
- cve@mitre.org
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.