CVE-2023-5118: Stored cross-site scripting vulnerability in Kofax Capture software
First published: Thu Jan 11 2024(Updated: )
The application is vulnerable to Stored Cross-Site Scripting (XSS) in the endpoint /sofer/DocumentService.asc/SaveAnnotation, where input data transmitted via the POST method in the parameters author and text are not adequately sanitized and validated. This allows for the injection of malicious JavaScript code. The vulnerability was identified in the function for adding new annotations while editing document content. Reporters inform that the vulnerability has been removed in software versions above 11.1.x. Previous versions may also be vulnerable, but this has not been confirmed.
Credit: cvd@cert.pl
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Kofax Capture | <=11.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-5118?
CVE-2023-5118 is classified as a high severity vulnerability due to the potential for Stored Cross-Site Scripting (XSS) attacks.
How do I fix CVE-2023-5118?
To remediate CVE-2023-5118, ensure that input validation and sanitization are implemented for the parameters author and text in the /sofer/DocumentService.asc/SaveAnnotation endpoint.
Which software is affected by CVE-2023-5118?
CVE-2023-5118 affects Tungstenautomation Kofax Capture versions up to and including 11.0.0.
What type of attack can occur due to CVE-2023-5118?
CVE-2023-5118 allows for Stored Cross-Site Scripting (XSS) attacks, which can inject malicious scripts into web pages viewed by users.
What are the consequences of CVE-2023-5118 exploitation?
Exploitation of CVE-2023-5118 could lead to unauthorized access, data manipulation, and the execution of malicious scripts in the context of an affected user.
- agent/references
- agent/type
- agent/weakness
- agent/author
- agent/description
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/last-modified-date
- agent/severity
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/tungstenautomation
- canonical/kofax capture
- version/kofax capture/11.0.0