CVE-2023-27195

Trimble TM4Web 22.2.0 allows unauthenticated attackers to access /inc/tmajax.msw?func=UserfromUUID&uuid= to retrieve the last registration access code and use this access code to register a valid account. via a PUT /inc/tmajax.msw request. If the access code was used to create an Administrator...

PT-2024-12124

Name of the Vulnerable Software and Affected Versions Trimble TM4Web version 22.2.0 Description The issue allows unauthenticated attackers to access the "/inc/tm ajax.msw?func=UserfromUUID&uuid=" endpoint to retrieve the last registration access code and use this access code to register a valid...

Trimble TM4Web 22.2.0 Privilege Escalation / Access Code Disclosure Vulnerability

An access control issue in Trimble TM4Web version 22.2.0 allows unauthenticated attackers to access a specific crafted URL path to retrieve the last registration access code and use this access code to register a valid account. If the access code was used to create an Administrator account,...