Read the docs
TI-2018-10003 Aliases CVE-2018-13791GHSA-x9mq-cf9p-6mqv

The HTTP API in ABBYY FlexiCapture before 12 Release 1 Update 7 allows an attacker to…

Priority MEDIUM 44CWE-732Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

The HTTP API in ABBYY FlexiCapture before 12 Release 1 Update 7 allows an attacker to conduct Access Control attacks via the /FlexiCapture12/Login/Server/SevaUserProfile FlexiCaptureTmsSts2 parameter.

Why it matters now

EPSS 0.01129 66th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:abbyy:flexicapture:12.0.1.263:*:*:*:*:*:*:*12.0.1.263VulnerableAbbyy
cpe:2.3:a:abbyy:flexicapture:12.0.1.267:*:*:*:*:*:*:*12.0.1.267VulnerableAbbyy
cpe:2.3:a:abbyy:flexicapture:12.0.1.282:*:*:*:*:*:*:*12.0.1.282VulnerableAbbyy
cpe:2.3:a:abbyy:flexicapture:12.0.1.292:*:*:*:*:*:*:*12.0.1.292VulnerableAbbyy
cpe:2.3:a:abbyy:flexicapture:12.0.1.367:*:*:*:*:*:*:*12.0.1.367VulnerableAbbyy
cpe:2.3:a:abbyy:flexicapture:12.0.1.428:*:*:*:*:*:*:*12.0.1.428VulnerableAbbyy
cpe:2.3:a:abbyy:flexicapture:12.0.1.475:*:*:*:*:*:*:*12.0.1.475VulnerableAbbyy
  • cpe:2.3:a:abbyy:flexicapture:12.0.1.263:*:*:*:*:*:*:* Versions 12.0.1.263 Vulnerable ·Abbyy
  • cpe:2.3:a:abbyy:flexicapture:12.0.1.267:*:*:*:*:*:*:* Versions 12.0.1.267 Vulnerable ·Abbyy
  • cpe:2.3:a:abbyy:flexicapture:12.0.1.282:*:*:*:*:*:*:* Versions 12.0.1.282 Vulnerable ·Abbyy
  • cpe:2.3:a:abbyy:flexicapture:12.0.1.292:*:*:*:*:*:*:* Versions 12.0.1.292 Vulnerable ·Abbyy
  • cpe:2.3:a:abbyy:flexicapture:12.0.1.367:*:*:*:*:*:*:* Versions 12.0.1.367 Vulnerable ·Abbyy
  • cpe:2.3:a:abbyy:flexicapture:12.0.1.428:*:*:*:*:*:*:* Versions 12.0.1.428 Vulnerable ·Abbyy
  • cpe:2.3:a:abbyy:flexicapture:12.0.1.475:*:*:*:*:*:*:* Versions 12.0.1.475 Vulnerable ·Abbyy

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-13791
  2. 2026-10-03 Alias added: GHSA-x9mq-cf9p-6mqv

References

Advisory 1

  • TI-2018-10004 Multiple SQL injection vulnerabilities in the monitoring feature in the HTTP API in ABBYY… CVSS 3.1CRITICAL 9.8
  • TI-2018-10005 Multiple Cross Site Request Forgery (CSRF) vulnerabilities in the HTTP API in ABBYY… CVSS 3.0HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences