CVE-2023-27195: Critical severity trimble tm4web vulnerability
Trimble TM4Web 22.2.0 allows unauthenticated attackers to access /inc/tmajax.msw?func=UserfromUUID&uuid= to retrieve the last registration access code and use this access code to register a valid account. via a PUT /inc/tmajax.msw request. If the access code was used to create an Administrator account, attackers are also able to register new Administrator accounts with full privileges.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-27195?
CVE-2023-27195 has been assigned a high severity level due to its potential for unauthorized account registration.
How do I fix CVE-2023-27195?
To fix CVE-2023-27195, you should update Trimble TM4Web to the latest version where this vulnerability has been patched.
What type of attack does CVE-2023-27195 enable?
CVE-2023-27195 enables unauthenticated attackers to exploit the system to register valid accounts using an access code.
What are the impacts of CVE-2023-27195 on Trimble TM4Web?
The impacts of CVE-2023-27195 include the risk of unauthorized users gaining administrative access to the system.
Is authentication required to exploit CVE-2023-27195?
No, CVE-2023-27195 can be exploited by unauthenticated attackers, making it particularly dangerous.