CVE-2024-36077
First published: Wed May 22 2024(Updated: )
Qlik Sense Enterprise for Windows before 14.187.4 allows a remote attacker to elevate their privilege due to improper validation. The attacker can elevate their privilege to the internal system role, which allows them to execute commands on the server. This affects February 2024 Patch 3 (14.173.3 through 14.173.7), November 2023 Patch 8 (14.159.4 through 14.159.13), August 2023 Patch 13 (14.139.3 through 14.139.20), May 2023 Patch 15 (14.129.3 through 14.129.22), February 2023 Patch 13 (14.113.1 through 14.113.18), November 2022 Patch 13 (14.97.2 through 14.97.18), August 2022 Patch 16 (14.78.3 through 14.78.23), and May 2022 Patch 17 (14.67.7 through 14.67.31). This has been fixed in May 2024 (14.187.4), February 2024 Patch 4 (14.173.8), November 2023 Patch 9 (14.159.14), August 2023 Patch 14 (14.139.21), May 2023 Patch 16 (14.129.23), February 2023 Patch 14 (14.113.19), November 2022 Patch 14 (14.97.19), August 2022 Patch 17 (14.78.25), and May 2022 Patch 18 (14.67.34).
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Qlik Sense | <14.187.4 | |
| Qlik Sense | >=14.173.3<=14.173.7>=14.159.4<=14.159.13>=14.139.3<=14.139.20>=14.129.3<=14.129.22>=14.113.1<=14.113.18>=14.97.2<=14.97.18>=14.78.3<=14.78.23>=14.67.7<=14.67.31 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-36077?
The severity of CVE-2024-36077 is classified as high due to the potential for remote privilege escalation.
How do I fix CVE-2024-36077?
To fix CVE-2024-36077, upgrade Qlik Sense Enterprise for Windows to version 14.187.4 or later.
What versions of Qlik Sense Enterprise for Windows are affected by CVE-2024-36077?
Affected versions include Qlik Sense Enterprise for Windows versions earlier than 14.187.4 and specific versions between 14.173.3 and 14.173.7.
Can CVE-2024-36077 be exploited remotely?
Yes, CVE-2024-36077 can be exploited by remote attackers to elevate their privileges on affected servers.
What are the potential impacts of exploiting CVE-2024-36077?
Exploiting CVE-2024-36077 could allow an attacker to gain access to internal system roles and execute arbitrary commands on the server.
- agent/references
- agent/description
- agent/type
- agent/severity
- agent/author
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/weakness
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/qlik
- canonical/qlik sense