Read the docs
TI-2023-04707 Aliases CVE-2023-5118GHSA-hqv4-427w-6698

Stored cross-site scripting vulnerability in Kofax Capture software

Priority LOW 24CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

The application is vulnerable to Stored Cross-Site Scripting (XSS) in the endpoint /sofer/DocumentService.asc/SaveAnnotation, where input data transmitted via the POST method in the parameters author and text are not adequately sanitized and validated. This allows for the injection of malicious JavaScript code. The vulnerability was identified in the function for adding new annotations while editing document content. Reporters inform that the vulnerability has been removed in software versions above 11.1.x. Previous versions may also be vulnerable, but this has not been confirmed.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00335 27th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
KofaxCapture11.0.0—No fix listedCNA
  • Capture VendorKofax Affected 11.0.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:tungstenautomation:kofax_capture:*:*:*:*:*:*:*:*up to 11.0.0VulnerableTungsten Automation
  • cpe:2.3:a:tungstenautomation:kofax_capture:*:*:*:*:*:*:*:* Versions up to 11.0.0 Vulnerable ·Tungsten Automation

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-5118
  2. 2026-10-03 Alias added: GHSA-hqv4-427w-6698

References

Advisory 2

  • TI-2022-08834 Printix Secure Cloud Print Management through 1.3.1106.0 incorrectly uses Privileged APIs… CVSS 3.1CRITICAL 9.8
  • TI-2018-04623 Remote Code Execution in Saperion Web Client version 7.5.2 83166. CVSS 3.0CRITICAL 9.8
  • TI-2022-08835 Printix Secure Cloud Print Management through 1.3.1106.0 creates a temporary temp.ini… CVSS 3.1HIGH 8.1
  • TI-2023-28218 Stack-based buffer overflow in Kofax Power PDF CVSS 3.0HIGH 7.8
  • TI-2024-20110 Out-of-bounds write in Kofax Power PDF CVSS 3.1HIGH 7.8
  • TI-2024-05124 Out-of-bounds write in Kofax Power PDF CVSS 3.1HIGH 7.8
See all 108 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences