PT-2024-14062 · Kofax+1 · Capture+1

Dawid Maåecki + 3 · Published 2024-01-11 · Updated 2024-01-18 · CVE-2023-5118

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Software versions prior to 11.1.x

Description The application is vulnerable to Stored Cross-Site Scripting (XSS) in the endpoint "/sofer/DocumentService.asc/SaveAnnotation", where input data transmitted via the POST method in the parameters author and text are not adequately sanitized and validated. This allows for the injection of malicious JavaScript code. The vulnerability was identified in the function for adding new annotations while editing document content.

Recommendations For versions prior to 11.1.x, update to a version above 11.1.x to resolve the issue. As a temporary workaround, consider restricting access to the "/sofer/DocumentService.asc/SaveAnnotation" endpoint or disabling the function for adding new annotations until a patch is available. Avoid using the parameters author and text in the affected API endpoint until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-5118

Affected Products

Capture

Kofax Capture

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-5118 · Security Note
• https://osv.dev/vulnerability/CVE-2023-5118 · Vendor Advisory
• https://cert.pl/posts/2024/01/CVE-2023-5118 · Note
• https://twitter.com/CVEnew/status/1745467913044128109 · Twitter Post
• https://cert.pl/en/posts/2024/01/CVE-2023-5118 · Note
• https://twitter.com/VulmonFeeds/status/1745500940088574089 · Twitter Post
• https://t.me/cvenotify/67868 · Telegram Post