PT-2024-12124 · Trimble · Trimble Tm4Web

Clément Cruchet + 1 · Published 2024-11-07 · Updated 2024-11-13 · CVE-2023-27195

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Trimble TM4Web version 22.2.0

Description The issue allows unauthenticated attackers to access the "/inc/tm ajax.msw?func=UserfromUUID&uuid=" endpoint to retrieve the last registration access code and use this access code to register a valid account via a PUT "/inc/tm ajax.msw" request. If the access code was used to create an Administrator account, attackers are also able to register new Administrator accounts with full privileges.

Recommendations For Trimble TM4Web version 22.2.0, update to the latest version to mitigate risks. As a temporary workaround, consider restricting access to the "/inc/tm ajax.msw" endpoint and the UserfromUUID function to minimize the risk of exploitation. Avoid using the uuid parameter in the affected API endpoint until the issue is resolved.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2023-27195

Affected Products

Trimble Tm4Web

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2023-27195 · Security Note
• https://t.me/cvedetector/10160 · Telegram Post
• https://twitter.com/transilienceai/status/1855839173464244280 · Twitter Post
• http://seclists.org/fulldisclosure/2024/Apr/16 · Note
• https://transportation.trimble.com/products/TM4Web · Note
• https://twitter.com/CVEnew/status/1854740398347817066 · Twitter Post
• https://twitter.com/cracbot/status/1856577792693154016 · Twitter Post
• https://t.me/cvenotify/101017 · Telegram Post
• https://twitter.com/transilienceai/status/1855839178371575853 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1854775341904023963 · Twitter Post
• https://seclists.org/fulldisclosure/2024/Apr/16 · Note