We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Trimble TM4Web 22.2.0 allows unauthenticated attackers to access /inc/tm_ajax.msw?func=UserfromUUID&uuid= to retrieve the last registration access code and use this access code to register a valid account. via a PUT /inc/tm_ajax.msw request. If the access code was used to create an Administrator account, attackers are also able to register new Administrator accounts with full privileges.
Reserved 2023-02-27 | Published 2024-11-08 | Updated 2024-11-08 | Assigner mitretransportation.trimble.com/products/TM4Web
seclists.org/fulldisclosure/2024/Apr/16
Support options
