PT-2024-9216 · Qlik · Qlik Sense Enterprise For Windows

Published 2024-12-04 · Updated 2024-12-14 · CVE-2024-55579

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:R

Name of the Vulnerable Software and Affected Versions: Qlik Sense Enterprise for Windows versions prior to November 2024 IR

Description: A problem was discovered in Qlik Sense Enterprise for Windows that allows an unprivileged user with network access to create connection objects, potentially triggering the execution of arbitrary EXE files. This issue is related to errors in processing input data from a higher-level component, which could enable a remote attacker to execute arbitrary code by creating specially formed connection objects.

Recommendations: For Qlik Sense Enterprise for Windows versions prior to November 2024 IR, update to the November 2024 IR or apply one of the following patches: May 2024 Patch 10, February 2024 Patch 14, November 2023 Patch 16, August 2023 Patch 16, May 2023 Patch 18, or February 2023 Patch 15. As a temporary workaround, consider restricting access to connection object creation to minimize the risk of exploitation.

Fix

Incorrect Authorization

Code Injection

Weakness Enumeration

CWE-863

CWE-94

CWE-152

Related Identifiers

BDU:2024-10904

BDU:2024-10982

CVE-2024-55579

Affected Products

Qlik Sense Enterprise For Windows

References · 24

• https://nvd.nist.gov/vuln/detail/CVE-2024-55579 · Security Note
• https://bdu.fstec.ru/vul/2024-10982 · Security Note
• https://bdu.fstec.ru/vul/2024-10904 · Security Note
• https://twitter.com/TweetThreatNews/status/1866049736228086180 · Twitter Post
• https://t.me/pentestingnews/54052 · Telegram Post
• https://twitter.com/Netlas_io/status/1866032670997692577 · Twitter Post
• https://community.qlik.com/t5/Official-Support-Articles/High-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows-CVE/tac-p/2496004 · Note
• https://securityonline.info/cve-2024-55579-cve-2024-55580-qlik-sense-users-face-serious-security-risk · Note
• https://t.me/netlas/287 · Telegram Post
• https://t.me/brutsecurity/1185 · Telegram Post
• https://community.qlik.com/t5/Official-Support-Articles/High-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows-CVEs/tac-p/2496004 · Note
• https://t.me/cvenotify/103494 · Telegram Post
• https://twitter.com/CVEnew/status/1865962189007303111 · Twitter Post
• https://twitter.com/CveFindCom/status/1865963060189351943 · Twitter Post
• https://twitter.com/vuldb/status/1866037953304449205 · Twitter Post