CVE-2015-3623

Related Files

Qlikview 11.20 SR4 Blind XXE Injection

Posted Sep 9, 2015

Authored by Alex Haynes

The Qlikview platform is vulnerable to XML External Entity (XXE) vulnerabilities. More specifically, the platform is susceptible to DTD parameter injections, which are also "blind" as the server feeds back no visual response. These vulnerabilities can be exploited to force Server Side Request Forgeries (SSRF)in multiple protocols, as well as reading and extracting arbitrary files on the server directly. Version 11.20 SR4 is vulnerable.

tags | exploit, arbitrary, vulnerability, protocol, xxe

advisories | CVE-2015-3623

SHA-256 | a5ff2a5356848862e8dae59e2e7566e7cec347863f2849477e43814c9500de31

Download | Favorite | View