PT-2022-6509 · Qlik · Qlikview

Giulio Garzia · Published 2022-10-03 · Updated 2023-03-13 · CVE-2022-42248

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:C/I:P/A:N

Name of the Vulnerable Software and Affected Versions QlikView version 12.60.2

Description The issue is related to the QvsViewClient functionality of the QlikView analytical platform, where the structure of web pages is not properly protected when creating interactive objects. This can be exploited by a remote attacker to perform cross-site scripting attacks by sending specially crafted POST requests. The estimated number of potentially affected devices worldwide is not specified.

Recommendations For QlikView version 12.60.2, consider disabling the QvsViewClient functionality until a patch is available to prevent potential cross-site scripting attacks. Restrict access to the QvsViewClient module to minimize the risk of exploitation. Avoid using the QvsViewClient functionality in the affected API endpoints until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-01821

CVE-2022-42248

Affected Products

Qlikview

References · 8

• https://bdu.fstec.ru/vul/2023-01821 · Security Note
• https://osv.dev/vulnerability/CVE-2022-42248 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-42248 · Security Note
• https://github.com/Ozozuz/Qlik-View-Stored-XSS · Note
• http://qlikview.com · Note
• https://community.qlik.com/t5/Release-Notes/QlikView-Release-Notes-May-2022-SR2/ta-p/2037704 · Note
• https://t.me/cibsecurity/59509 · Telegram Post
• https://t.me/cvenotify/45657 · Telegram Post