CVE-2022-35497 in TM4WEB
Summary
by MITRE • 09/04/2026
In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reflected cross-site scripting affecting the external document viewer endpoint.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified in Trimble TM4WEB version 21.4.0.4 stems from a critical security misconfiguration involving the handling of session identifiers within the application's architecture. Specifically, the flaw resides in the implementation of the external document viewer endpoint, which fails to adequately sanitize user-supplied input before processing it for display or execution. This lack of proper validation allows an attacker to inject malicious script payloads directly into HTTP responses that are reflected back to the victim's browser. The core technical deficiency is a classic Reflected Cross-Site Scripting (XSS) vulnerability, where the application incorporates untrusted data from the request URL or parameters without sufficient filtering, thereby enabling the execution of arbitrary JavaScript code in the context of the vulnerable web page.
From an operational perspective, this vulnerability poses a severe risk to session integrity and user confidentiality. Because the XSS payload is reflected via the external document viewer endpoint, it can be delivered through deceptive links shared with targeted users or embedded in malicious websites. When a victim clicks such a link while authenticated to Trimble TM4WEB, their browser executes the injected script within the application's security context. This allows an attacker to access sensitive session cookies that are typically protected by HttpOnly flags if not properly configured, or more commonly, it enables the extraction of other non-HttpOnly session tokens and user-specific data stored in local storage or DOM elements. The ability to recover valid session identifiers effectively grants the attacker full control over the victim's active session, leading to unauthorized access to confidential project data, financial records, and proprietary engineering documents hosted within the Trimble ecosystem.
This incident aligns with CWE-79, which classifies Improper Neutralization of Input During Web Page Generation as a Cross-site Scripting weakness. The exploitation vector leverages the trust that users place in the application domain to bypass same-origin policies and perform actions on behalf of the victim without their consent. In terms of offensive security frameworks, this vulnerability maps directly to MITRE ATT&CK technique T1059.007, which covers JavaScript as a client-side script execution vector. The attacker utilizes this capability for Credential Access (T1539) by stealing session cookies or tokens, and potentially for Data Exfiltration if the malicious script is designed to send stolen data to an external command-and-control server.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. Trimble should immediately release a patch that enforces strict input validation and output encoding on all parameters processed by the external document viewer endpoint. Developers must implement Content Security Policy (CSP) headers to restrict the sources from which scripts can be loaded, thereby neutralizing many XSS attacks even if injection occurs. Additionally, session cookies should be configured with HttpOnly, Secure, and SameSite attributes to prevent client-side script access and cross-site request forgery. On a broader scale, organizations deploying Trimble TM4WEB should ensure that their web application firewalls are updated to detect and block known XSS patterns targeting this specific endpoint until the patch is applied. Regular security audits and penetration testing focused on input validation across all external-facing endpoints will help identify similar misconfigurations before they can be exploited in production environments.