CVE-2019-11628: High severity qlikview server vulnerability

Published May 1, 2019

Updated

An issue was discovered in QlikView Server before 11.20 SR19, 12.00 and 12.10 before 12.10 SR11, 12.20 before SR9, and 12.30 before SR2; and Qlik Sense Enterprise and Qlik Analytics Platform installations that lack these patch levels: February 2018 Patch 4, April 2018 Patch 3, June 2018 Patch 3, September 2018 Patch 4, November 2018 Patch 4, or February 2019 Patch 2. An authenticated user may be able to bypass intended file-read restrictions via crafted Browser requests.

Affected Software

50 affected components

Qlik QlikView Server=11.20-service_release_1

Qlik QlikView Server=11.20-service_release_10

Qlik QlikView Server=11.20-service_release_11

Qlik QlikView Server=11.20-service_release_12

Qlik QlikView Server=11.20-service_release_13

Qlik QlikView Server=11.20-service_release_14

Qlik QlikView Server=11.20-service_release_15

Qlik QlikView Server=11.20-service_release_16

Qlik QlikView Server=11.20-service_release_17

Qlik QlikView Server=11.20-service_release_2

Qlik QlikView Server=11.20-service_release_3

Qlik QlikView Server=11.20-service_release_4

Qlik QlikView Server=11.20-service_release_5

Qlik QlikView Server=11.20-service_release_6

Qlik QlikView Server=11.20-service_release_7

Qlik QlikView Server=11.20-service_release_8

Qlik QlikView Server=11.20-service_release_9

Qlik QlikView Server=12.00

Qlik QlikView Server=12.10-service_release_1

Qlik QlikView Server=12.10-service_release_2

Qlik QlikView Server=12.10-service_release_3

Qlik QlikView Server=12.10-service_release_4

Qlik QlikView Server=12.10-service_release_5

Qlik QlikView Server=12.10-service_release_6

Qlik QlikView Server=12.10-service_release_7

Qlik QlikView Server=12.10-service_release_8

Qlik QlikView Server=12.10-service_release_9

Qlik QlikView Server=12.20-service_release_1

Qlik QlikView Server=12.20-service_release_2

Qlik QlikView Server=12.20-service_release_3

Qlik QlikView Server=12.20-service_release_4

Qlik QlikView Server=12.30-service_release_1

Qlik Qlik Analytics=april_2018

Qlik Qlik Analytics=february_2018

Qlik Qlik Analytics=february_2019

Qlik Qlik Analytics=june_2017

Qlik Qlik Analytics=june_2018

Qlik Qlik Analytics=november_2017

Qlik Qlik Analytics=november_2018

Qlik Qlik Analytics=september_2017

Qlik Qlik Analytics=september_2018

Qlik Qlik Sense=april_2018

Qlik Qlik Sense=february_2018

Qlik Qlik Sense=february_2019

Qlik Qlik Sense=june_2017

Qlik Qlik Sense=june_2018

Qlik Qlik Sense=november_2017

Qlik Qlik Sense=november_2018

Qlik Qlik Sense=september_2017

Qlik Qlik Sense=september_2018

Event History

May 1, 2019

CVE Published

via MITRE·02:07 AM

Data Sourced

via MITRE·02:07 AM

DescriptionSeverity

Frequently Asked Questions

What is the severity of CVE-2019-11628?

CVE-2019-11628 has a severity rating of medium, indicating potential security risks.

How do I fix CVE-2019-11628?

To fix CVE-2019-11628, apply the latest patches for QlikView Server and Qlik Sense Enterprise as specified in the vendor's advisory.

Which versions of Qlik are affected by CVE-2019-11628?

CVE-2019-11628 affects QlikView Server versions prior to 11.20 SR19 and various versions of Qlik Sense prior to the specified patch levels.

What types of installations are impacted by CVE-2019-11628?

CVE-2019-11628 impacts installations of QlikView Server, Qlik Sense Enterprise, and Qlik Analytics Platform that are not updated to the necessary patch versions.

Is there a workaround for CVE-2019-11628?

There are no known workarounds for CVE-2019-11628; the only solution is to apply the required patches.