XML External Entity Vulnerability in QlikTech Qlikview
CVE-2015-3623

Currently unrated

Key Information:

Vendor

Qlik

Status
Qlikview
Vendor
CVE Published:
16 September 2015

What is CVE-2015-3623?

An XML External Entity (XXE) vulnerability exists in QlikTech's Qlikview prior to version 11.20 SR12. This flaw allows remote attackers to perform server-side request forgery (SSRF) attacks by crafting malicious XML data sent to AccessPoint.aspx, enabling them to gain unauthorized access to sensitive files within the server environment.

References

https://www.exploit-db.com/exploits/38118/
exploitx_refsource_EXPLOIT-DB
http://packetstormsecurity.com/files/133499/Qlikview-11.2...
x_refsource_MISC
http://www.securityfocus.com/archive/1/536411/100/0/threaded
mailing-listx_refsource_BUGTRAQ

EPSS Score

6% chance of being exploited in the next 30 days.

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.