Medium severity · published May 1, 2019
CVE-2019-11628
An issue was discovered in QlikView Server before 11.20 SR19, 12.00 and 12.10 before 12.10 SR11, 12.20 before SR9, and 12.30 before SR2; and Qlik Sense Enterprise and Qlik…
6.5
CVSS
1%
EPSS
No
On KEV
Description
An issue was discovered in QlikView Server before 11.20 SR19, 12.00 and 12.10 before 12.10 SR11, 12.20 before SR9, and 12.30 before SR2; and Qlik Sense Enterprise and Qlik Analytics Platform installations that lack these patch levels: February 2018 Patch 4, April 2018 Patch 3, June 2018 Patch 3, September 2018 Patch 4, November 2018 Patch 4, or February 2019 Patch 2. An authenticated user may be able to bypass intended file-read restrictions via crafted Browser requests.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QS
Qlik Sense · Qlik
april_2018; february_2018; february_2019; june_2017; june_2018; november_2017; +3 more · source: NVD
QA
Qlik Analytics · Qlik
april_2018; february_2018; february_2019; june_2017; june_2018; november_2017; +3 more · source: NVD
QS
Qlikview Server · Qlik
11.20; 11.20; 11.20; 11.20; 11.20; 11.20; +26 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-11628
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-11628
Vendor Advisory
https://qliksupport.force.com/articles/000069985
More from Qlik Sense
9.9
CVE-2023-48365
Qlik Sense HTTP Tunneling Vulnerability
9.9
CVE-2023-41265
Qlik Sense HTTP Tunneling Vulnerability
6.5
CVE-2023-41266
Qlik Sense Path Traversal Vulnerability
7.5
CVE-2025-61138
Qlik Sense Enterprise v14.212.13 was discovered to contain an information leak via the /dev-hub/ directory
5.3
CVE-2021-36761
The GeoAnalytics feature in Qlik Sense April 2020 patch 4 allows SSRF