{"id":"CVE-2022-35497","title":"In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reflected cross-site scripting affecting the external document viewer endpoint.","summary":"In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reflected cross-site scripting affecting the external document viewer endpoint.","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79"],"published":"2026-09-04","updated":"2026-09-14","sourceUpdated":"2026-09-14T14:17:05.820","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2022-35497","references":[{"url":"http://tm4web.com","label":"cve@mitre.org"},{"url":"http://trimble.com","label":"cve@mitre.org"},{"url":"https://github.com/PN-Tester/CVE-2022-35497/tree/main","label":"cve@mitre.org"}],"tags":["nvd","cve.org","exploit-available"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-14T13:23:26.417950Z"},"epss":0.00255,"epssPercentile":0.17428,"exploits":{"github":1,"githubRepos":["https://github.com/PN-Tester/CVE-2022-35497"],"checkedAt":"2026-09-23T07:13:40.103Z"},"exploitAvailable":true,"ingestedAt":"2026-09-08T20:10:03.166Z","slug":"CVE-2022-35497","body":"## Overview\n\nIn Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reflected cross-site scripting affecting the external document viewer endpoint.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":29.7,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":201417,"id":"CVE-2022-35497","ts":1789399422391,"field":"cvss","old":null,"new":"5.4"},{"seq":201416,"id":"CVE-2022-35497","ts":1789399422391,"field":"severity","old":"none","new":"medium"},{"seq":200152,"id":"CVE-2022-35497","ts":1789396867673,"field":"cvss","old":"5.4","new":null},{"seq":200151,"id":"CVE-2022-35497","ts":1789396867673,"field":"severity","old":"medium","new":"none"},{"seq":200101,"id":"CVE-2022-35497","ts":1789395646940,"field":"cvss","old":null,"new":"5.4"},{"seq":200100,"id":"CVE-2022-35497","ts":1789395646940,"field":"severity","old":"none","new":"medium"}]}