What is CVE-2022-35497?

CVE-2022-35497 is a vulnerability. Published 2026-09-04.

Is CVE-2022-35497 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

CVE-2022-35497

CVE-2022-35497

In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reflected cross-site scripting affecting the external document viewer endpoint.

Public proof-of-concept exploits

PN-Tester/CVE-2022-35497

References

cve@mitre.org
cve@mitre.org
cve@mitre.org

Frequently asked questions

What is CVE-2022-35497?: CVE-2022-35497 is a vulnerability. Published 2026-09-04.
Is CVE-2022-35497 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.