CVE-2022-0564: Qlik Sense Enterprise Domain User enumeration
A vulnerability in Qlik Sense Enterprise on Windows could allow an remote attacker to enumerate domain user accounts. An attacker could exploit this vulnerability by sending authentication requests to an affected system. A successful exploit could allow the attacker to compare the response time that are returned by the affected system to determine which accounts are valid user accounts. Affected systems are only vulnerable if they have LDAP configured.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2022-0564?
CVE-2022-0564 is classified as a medium severity vulnerability.
How do I fix CVE-2022-0564?
To mitigate CVE-2022-0564, update Qlik Sense Enterprise to version 14.45 or later.
What systems are affected by CVE-2022-0564?
CVE-2022-0564 affects Qlik Sense Enterprise versions from 14.0 to 14.44.0 running on Windows.
What can an attacker achieve by exploiting CVE-2022-0564?
Exploiting CVE-2022-0564 allows an attacker to enumerate domain user accounts through authentication requests.
Is CVE-2022-0564 easy to exploit?
CVE-2022-0564 can be exploited by sending authentication requests, making it relatively straightforward for attackers with necessary access.