CVE-2023-5118— Stored cross-site scripting vulnerability in Kofax Capture software
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2023-5118
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Stored cross-site scripting vulnerability in Kofax Capture software
Source: NVD (National Vulnerability Database)
Vulnerability Description
The application is vulnerable to Stored Cross-Site Scripting (XSS) in the endpoint /sofer/DocumentService.asc/SaveAnnotation, where input data transmitted via the POST method in the parameters author and text are not adequately sanitized and validated. This allows for the injection of malicious JavaScript code. The vulnerability was identified in the function for adding new annotations while editing document content. Reporters inform that the vulnerability has been removed in software versions above 11.1.x. Previous versions may also be vulnerable, but this has not been confirmed.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Kofax Capture 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Kofax Capture是美国Kofax公司的一个应用程序。提供一流的预构建智能文档处理功能。 Kofax Capture 11.0.0及之前版本存在跨站脚本漏洞，该漏洞源于端点 /sofer/DocumentService.asc/SaveAnnotation 容易受到跨站脚本攻击，通过参数author、 text使用 POST 方法传输的输入数据没有得到充分的清理和验证。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2023-5118
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-5118
请登录查看更多情报信息。
- https://cert.pl/posts/2024/01/CVE-2023-5118/third-party-advisory
- https://cert.pl/en/posts/2024/01/CVE-2023-5118/third-party-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-5118
IV. Related Vulnerabilities
Same vendor: Kofax
- CVE-2024-5513
Kofax Power PDF JP2 File Parsing Out-Of-Bounds Write Remote - CVE-2024-5512
Kofax Power PDF JP2 File Parsing Out-Of-Bounds Read Informat - CVE-2024-5511
Kofax Power PDF JP2 File Parsing Out-Of-Bounds Read Remote C - CVE-2024-5510
Kofax Power PDF JP2 File Parsing Out-Of-Bounds Read Remote C - CVE-2024-30373
Kofax Power PDF JPF File Parsing Out-Of-Bounds Write Remote
Same weakness: CWE-79
- CVE-2026-27964
FacturaScripts: Reflected Cross-Site Scripting (XSS) via Coo - CVE-2026-27737
BigBlueButton has Stored XSS in bbb-playback replay - CVE-2026-45231
DumbAssets 1.0.11 Stored Cross-Site Scripting via Asset Fiel - CVE-2026-45494
Microsoft Edge (Chromium-based) Spoofing Vulnerability - CVE-2026-7498
Stored XSS in Basamak Informatics' DernekWeb
V. Comments for CVE-2023-5118
No comments yet