PT-2019-8972 · Abbyy · Abbyy Flexicapture

Published 2019-02-10 · Updated 2020-09-10 · CVE-2018-13792

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ABBYY FlexiCapture versions prior to 12 Release 2

Description The issue concerns SQL injection vulnerabilities in the monitoring feature of the HTTP API. An attacker can execute arbitrary SQL commands by manipulating the mask, sortOrder, filter, or Order parameters.

Recommendations For versions prior to 12 Release 2, update to version 12 Release 2 or later to resolve the issue.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2018-13792

Affected Products

Abbyy Flexicapture

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-13792 · Security Note
• http://abbyydownloads.com/fc12/ReleaseNotes_FC12_R2_U6_1299.29_build_12.0.2.1420.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-13792 · Vendor Advisory