# CVE-2022-35497: Trimble TM4WEB session hijacking via reflected XSS

Source: https://junglewise.ai/threats/cve-2022-35497-trimble-tm4web-session-hijacking-via-reflected-xss  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-04. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2022-35497 · Severity: medium · CVSS 5.4 · Published 2026-09-04

Trimble TM4WEB is a document management and viewing application used by organizations to store and access important business documents. Due to improper session handling combined with a reflected cross-site scripting vulnerability in the external document viewer, attackers can steal valid session cookies and hijack user accounts to access confidential documents and project data.

Vendors: [Trimble](https://junglewise.ai/threats/vendors/trimble).

## Quick answers

**Is CVE-2022-35497 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-35497 being exploited in the wild.

**How severe is CVE-2022-35497?** Medium severity, with a CVSS score of 5.4, published 4 September 2026.

**Which products and versions are affected?** Trimble TM4WEB 21.4.0.4.

**Is there a fix for CVE-2022-35497?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2022-35497 attacked?** It is attacked over the network.

**Am I affected by CVE-2022-35497?** Check whether you run Trimble TM4WEB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a reflected cross-site scripting (XSS) flaw in the external document viewer endpoint of TM4WEB 21.4.0.4, combined with insecure session identifier configuration. An attacker crafts a malicious URL containing JavaScript payload that, when clicked by a victim, executes in their browser context and extracts the session cookie. The stolen session identifier can then be reused to impersonate the victim. The vulnerability requires user interaction (clicking a malicious link) but can be delivered via email or social engineering. No authentication is required from the attacker's perspective to craft or send the exploit. Patches or workarounds should be verified with Trimble support.

## Affected products

- Trimble TM4WEB 21.4.0.4

## Timeline

- 2022-09-04: disclosed

## References

- [http://tm4web.com/](http://tm4web.com/)
- [http://trimble.com/](http://trimble.com/)

## Related threats

- [Trimble TM4WEB reflected cross-site scripting in bill viewer](https://junglewise.ai/threats/cve-2022-35499-trimble-tm4web-reflected-cross-site-scripting-in-bill-viewer)