CVE-2022-35497

在 Trimble 的 TM4WEB =22.2.0 中，由于会话标识符的安全配置错误，攻击者可能通过影响外部文档查看器端点的反射型跨站脚本恢复有效的会话 Cookie。 具体而言，用于维持会话的三个 Cookie 分别是 UID、rstring 和 PHPSESSIONID，它们均未设置适当的 HttpOnly 标志，因而无法防止通过 JavaScript 执行向量恢复 Cookie。 步骤 1 : 攻击者利用反射型跨站脚本漏洞 CVE-2022-35499 获取已认证受害者的会话 Cookie。 攻击者会在面向互联网且可接收 HTTP...

CVE-2023-27195

Trimble TM4Web 22.2.0 allows unauthenticated attackers to access /inc/tmajax.msw?func=UserfromUUID= to retrieve the last registration access code and use this access code to register a valid account. via a PUT /inc/tmajax.msw request. If the access code was used to create an Administrator account...

CVE-2023-27195

Trimble TM4Web 22.2.0 allows unauthenticated attackers to access /inc/tmajax.msw?func=UserfromUUID&uuid= to retrieve the last registration access code and use this access code to register a valid account. via a PUT /inc/tmajax.msw request. If the access code was used to create an Administrator...

CVE-2023-27195

Trimble TM4Web 22.2.0 allows unauthenticated attackers to access /inc/tmajax.msw?func=UserfromUUID&uuid= to retrieve the last registration access code and use this access code to register a valid account. via a PUT /inc/tmajax.msw request. If the access code was used to create an Administrator...

CVE-2023-27195

Trimble TM4Web 22.2.0 allows unauthenticated attackers to access /inc/tmajax.msw?func=UserfromUUID&uuid= to retrieve the last registration access code and use this access code to register a valid account. via a PUT /inc/tmajax.msw request. If the access code was used to create an Administrator...

CVE-2023-27195

The provided connected documents confirm a concrete vulnerability in Trimble TM4Web 22.2.0: an unauthenticated user can access a URL to retrieve the last registration access code and then use a PUT request to register a new account. If the retrieved code was used to create an Administrator accoun...

Trimble TM4Web 22.2.0 Privilege Escalation / Access Code Disclosure Vulnerability

An access control issue in Trimble TM4Web version 22.2.0 allows unauthenticated attackers to access a specific crafted URL path to retrieve the last registration access code and use this access code to register a valid account. If the access code was used to create an Administrator account,...