CVE-2024-7875

Tungsten Automation(Kofax) TotalAgility in versions all through7.9.0.25.0.954 is vulnerable to a Reflected XSS attacks through mfpScreenResolutionWidthparameter manipulation in a form sent to anendpoint/TotalAgility/Kofax/BrowserDevice/ScanFront.aspx
This allows for injection of a malicious JavaScript code, leading to a possible information leak.
Exploitation is possible only while using POST requests and also requires retrieving/generating a proper VIEWSTATE parameter, which limits the risk of a successful attack.