PT-2024-9294 · Qlik · Qlik Sense Enterprise For Windows

Published 2024-12-04 · Updated 2024-12-14 · CVE-2024-55580

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Qlik Sense Enterprise for Windows versions prior to November 2024 IR

Description: The issue allows unprivileged users with network access to execute remote commands, potentially causing high availability damages, including high integrity and confidentiality risks. This is due to incorrect code generation management. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

Recommendations: For Qlik Sense Enterprise for Windows versions prior to November 2024 IR, apply the November 2024 IR, May 2024 Patch 10, February 2024 Patch 14, November 2023 Patch 16, August 2023 Patch 16, May 2023 Patch 18, or February 2023 Patch 15 to resolve the issue. As a temporary workaround, consider restricting network access to prevent unprivileged users from executing remote commands.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2024-10982

CVE-2024-55580

Affected Products

Qlik Sense Enterprise For Windows

References · 17

• https://nvd.nist.gov/vuln/detail/CVE-2024-55580 · Security Note
• https://bdu.fstec.ru/vul/2024-10982 · Security Note
• https://twitter.com/TweetThreatNews/status/1866049736228086180 · Twitter Post
• https://twitter.com/cracbot/status/1867811817558540759 · Twitter Post
• https://t.me/pentestingnews/54052 · Telegram Post
• https://twitter.com/CVEnew/status/1865962190244647208 · Twitter Post
• https://twitter.com/fridaysecurity/status/1865969239510630894 · Twitter Post
• https://t.me/cvenotify/103495 · Telegram Post
• https://t.me/cvedetector/12350 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1865974824662659154 · Twitter Post
• https://community.qlik.com/t5/Official-Support-Articles/High-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows-CVE/tac-p/2496004 · Note
• https://securityonline.info/cve-2024-55579-cve-2024-55580-qlik-sense-users-face-serious-security-risk · Note
• https://twitter.com/cracbot/status/1867087080607846504 · Twitter Post
• https://twitter.com/CCBalert/status/1866140457429803435 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1865969554440257941 · Twitter Post