Read the docs
TI-2019-08701 Aliases CVE-2019-11628GHSA-5pxw-q4pw-rmwh

An issue was discovered in QlikView Server before 11.20 SR19, 12.00 and 12.10 before…

Priority LOW 38CWE-917Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-917.

Summary

An issue was discovered in QlikView Server before 11.20 SR19, 12.00 and 12.10 before 12.10 SR11, 12.20 before SR9, and 12.30 before SR2; and Qlik Sense Enterprise and Qlik Analytics Platform installations that lack these patch levels: February 2018 Patch 4, April 2018 Patch 3, June 2018 Patch 3, September 2018 Patch 4, November 2018 Patch 4, or February 2019 Patch 2. An authenticated user may be able to bypass intended file-read restrictions via crafted Browser requests.

Why it matters now

EPSS 0.00973 62nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 50

CPEVersionsRoleVendor
cpe:2.3:a:qlik:qlikview_server:11.20:service_release_1:*:*:*:*:*:*11.20 service_release_1VulnerableQlik
cpe:2.3:a:qlik:qlikview_server:11.20:service_release_10:*:*:*:*:*:*11.20 service_release_10VulnerableQlik
cpe:2.3:a:qlik:qlikview_server:11.20:service_release_11:*:*:*:*:*:*11.20 service_release_11VulnerableQlik
cpe:2.3:a:qlik:qlikview_server:11.20:service_release_12:*:*:*:*:*:*11.20 service_release_12VulnerableQlik
cpe:2.3:a:qlik:qlikview_server:11.20:service_release_13:*:*:*:*:*:*11.20 service_release_13VulnerableQlik
cpe:2.3:a:qlik:qlikview_server:11.20:service_release_14:*:*:*:*:*:*11.20 service_release_14VulnerableQlik
cpe:2.3:a:qlik:qlikview_server:11.20:service_release_15:*:*:*:*:*:*11.20 service_release_15VulnerableQlik
cpe:2.3:a:qlik:qlikview_server:11.20:service_release_16:*:*:*:*:*:*11.20 service_release_16VulnerableQlik
cpe:2.3:a:qlik:qlikview_server:11.20:service_release_17:*:*:*:*:*:*11.20 service_release_17VulnerableQlik
cpe:2.3:a:qlik:qlikview_server:11.20:service_release_2:*:*:*:*:*:*11.20 service_release_2VulnerableQlik
  • cpe:2.3:a:qlik:qlikview_server:11.20:service_release_1:*:*:*:*:*:* Versions 11.20 service_release_1 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlikview_server:11.20:service_release_10:*:*:*:*:*:* Versions 11.20 service_release_10 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlikview_server:11.20:service_release_11:*:*:*:*:*:* Versions 11.20 service_release_11 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlikview_server:11.20:service_release_12:*:*:*:*:*:* Versions 11.20 service_release_12 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlikview_server:11.20:service_release_13:*:*:*:*:*:* Versions 11.20 service_release_13 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlikview_server:11.20:service_release_14:*:*:*:*:*:* Versions 11.20 service_release_14 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlikview_server:11.20:service_release_15:*:*:*:*:*:* Versions 11.20 service_release_15 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlikview_server:11.20:service_release_16:*:*:*:*:*:* Versions 11.20 service_release_16 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlikview_server:11.20:service_release_17:*:*:*:*:*:* Versions 11.20 service_release_17 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlikview_server:11.20:service_release_2:*:*:*:*:*:* Versions 11.20 service_release_2 Vulnerable ·Qlik
Show 40 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:qlik:qlikview_server:11.20:service_release_3:*:*:*:*:*:*11.20 service_release_3VulnerableQlik
cpe:2.3:a:qlik:qlikview_server:11.20:service_release_4:*:*:*:*:*:*11.20 service_release_4VulnerableQlik
cpe:2.3:a:qlik:qlikview_server:11.20:service_release_5:*:*:*:*:*:*11.20 service_release_5VulnerableQlik
cpe:2.3:a:qlik:qlikview_server:11.20:service_release_6:*:*:*:*:*:*11.20 service_release_6VulnerableQlik
cpe:2.3:a:qlik:qlikview_server:11.20:service_release_7:*:*:*:*:*:*11.20 service_release_7VulnerableQlik
cpe:2.3:a:qlik:qlikview_server:11.20:service_release_8:*:*:*:*:*:*11.20 service_release_8VulnerableQlik
cpe:2.3:a:qlik:qlikview_server:11.20:service_release_9:*:*:*:*:*:*11.20 service_release_9VulnerableQlik
cpe:2.3:a:qlik:qlikview_server:12.00:*:*:*:*:*:*:*12.00VulnerableQlik
cpe:2.3:a:qlik:qlikview_server:12.10:service_release_1:*:*:*:*:*:*12.10 service_release_1VulnerableQlik
cpe:2.3:a:qlik:qlikview_server:12.10:service_release_2:*:*:*:*:*:*12.10 service_release_2VulnerableQlik
cpe:2.3:a:qlik:qlikview_server:12.10:service_release_3:*:*:*:*:*:*12.10 service_release_3VulnerableQlik
cpe:2.3:a:qlik:qlikview_server:12.10:service_release_4:*:*:*:*:*:*12.10 service_release_4VulnerableQlik
cpe:2.3:a:qlik:qlikview_server:12.10:service_release_5:*:*:*:*:*:*12.10 service_release_5VulnerableQlik
cpe:2.3:a:qlik:qlikview_server:12.10:service_release_6:*:*:*:*:*:*12.10 service_release_6VulnerableQlik
cpe:2.3:a:qlik:qlikview_server:12.10:service_release_7:*:*:*:*:*:*12.10 service_release_7VulnerableQlik
cpe:2.3:a:qlik:qlikview_server:12.10:service_release_8:*:*:*:*:*:*12.10 service_release_8VulnerableQlik
cpe:2.3:a:qlik:qlikview_server:12.10:service_release_9:*:*:*:*:*:*12.10 service_release_9VulnerableQlik
cpe:2.3:a:qlik:qlikview_server:12.20:service_release_1:*:*:*:*:*:*12.20 service_release_1VulnerableQlik
cpe:2.3:a:qlik:qlikview_server:12.20:service_release_2:*:*:*:*:*:*12.20 service_release_2VulnerableQlik
cpe:2.3:a:qlik:qlikview_server:12.20:service_release_3:*:*:*:*:*:*12.20 service_release_3VulnerableQlik
cpe:2.3:a:qlik:qlikview_server:12.20:service_release_4:*:*:*:*:*:*12.20 service_release_4VulnerableQlik
cpe:2.3:a:qlik:qlikview_server:12.30:service_release_1:*:*:*:*:*:*12.30 service_release_1VulnerableQlik
cpe:2.3:a:qlik:qlik_analytics:april_2018:*:*:*:*:*:*:*april_2018VulnerableQlik
cpe:2.3:a:qlik:qlik_analytics:february_2018:*:*:*:*:*:*:*february_2018VulnerableQlik
cpe:2.3:a:qlik:qlik_analytics:february_2019:*:*:*:*:*:*:*february_2019VulnerableQlik
cpe:2.3:a:qlik:qlik_analytics:june_2017:*:*:*:*:*:*:*june_2017VulnerableQlik
cpe:2.3:a:qlik:qlik_analytics:june_2018:*:*:*:*:*:*:*june_2018VulnerableQlik
cpe:2.3:a:qlik:qlik_analytics:november_2017:*:*:*:*:*:*:*november_2017VulnerableQlik
cpe:2.3:a:qlik:qlik_analytics:november_2018:*:*:*:*:*:*:*november_2018VulnerableQlik
cpe:2.3:a:qlik:qlik_analytics:september_2017:*:*:*:*:*:*:*september_2017VulnerableQlik
cpe:2.3:a:qlik:qlik_analytics:september_2018:*:*:*:*:*:*:*september_2018VulnerableQlik
cpe:2.3:a:qlik:qlik_sense:april_2018:*:*:*:enterprise:*:*:*april_2018VulnerableQlik
cpe:2.3:a:qlik:qlik_sense:february_2018:*:*:*:enterprise:*:*:*february_2018VulnerableQlik
cpe:2.3:a:qlik:qlik_sense:february_2019:*:*:*:enterprise:*:*:*february_2019VulnerableQlik
cpe:2.3:a:qlik:qlik_sense:june_2017:*:*:*:enterprise:*:*:*june_2017VulnerableQlik
cpe:2.3:a:qlik:qlik_sense:june_2018:*:*:*:enterprise:*:*:*june_2018VulnerableQlik
cpe:2.3:a:qlik:qlik_sense:november_2017:*:*:*:enterprise:*:*:*november_2017VulnerableQlik
cpe:2.3:a:qlik:qlik_sense:november_2018:*:*:*:enterprise:*:*:*november_2018VulnerableQlik
cpe:2.3:a:qlik:qlik_sense:september_2017:*:*:*:enterprise:*:*:*september_2017VulnerableQlik
cpe:2.3:a:qlik:qlik_sense:september_2018:*:*:*:enterprise:*:*:*september_2018VulnerableQlik
  • cpe:2.3:a:qlik:qlikview_server:11.20:service_release_3:*:*:*:*:*:* Versions 11.20 service_release_3 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlikview_server:11.20:service_release_4:*:*:*:*:*:* Versions 11.20 service_release_4 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlikview_server:11.20:service_release_5:*:*:*:*:*:* Versions 11.20 service_release_5 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlikview_server:11.20:service_release_6:*:*:*:*:*:* Versions 11.20 service_release_6 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlikview_server:11.20:service_release_7:*:*:*:*:*:* Versions 11.20 service_release_7 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlikview_server:11.20:service_release_8:*:*:*:*:*:* Versions 11.20 service_release_8 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlikview_server:11.20:service_release_9:*:*:*:*:*:* Versions 11.20 service_release_9 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlikview_server:12.00:*:*:*:*:*:*:* Versions 12.00 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlikview_server:12.10:service_release_1:*:*:*:*:*:* Versions 12.10 service_release_1 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlikview_server:12.10:service_release_2:*:*:*:*:*:* Versions 12.10 service_release_2 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlikview_server:12.10:service_release_3:*:*:*:*:*:* Versions 12.10 service_release_3 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlikview_server:12.10:service_release_4:*:*:*:*:*:* Versions 12.10 service_release_4 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlikview_server:12.10:service_release_5:*:*:*:*:*:* Versions 12.10 service_release_5 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlikview_server:12.10:service_release_6:*:*:*:*:*:* Versions 12.10 service_release_6 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlikview_server:12.10:service_release_7:*:*:*:*:*:* Versions 12.10 service_release_7 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlikview_server:12.10:service_release_8:*:*:*:*:*:* Versions 12.10 service_release_8 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlikview_server:12.10:service_release_9:*:*:*:*:*:* Versions 12.10 service_release_9 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlikview_server:12.20:service_release_1:*:*:*:*:*:* Versions 12.20 service_release_1 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlikview_server:12.20:service_release_2:*:*:*:*:*:* Versions 12.20 service_release_2 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlikview_server:12.20:service_release_3:*:*:*:*:*:* Versions 12.20 service_release_3 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlikview_server:12.20:service_release_4:*:*:*:*:*:* Versions 12.20 service_release_4 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlikview_server:12.30:service_release_1:*:*:*:*:*:* Versions 12.30 service_release_1 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_analytics:april_2018:*:*:*:*:*:*:* Versions april_2018 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_analytics:february_2018:*:*:*:*:*:*:* Versions february_2018 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_analytics:february_2019:*:*:*:*:*:*:* Versions february_2019 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_analytics:june_2017:*:*:*:*:*:*:* Versions june_2017 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_analytics:june_2018:*:*:*:*:*:*:* Versions june_2018 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_analytics:november_2017:*:*:*:*:*:*:* Versions november_2017 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_analytics:november_2018:*:*:*:*:*:*:* Versions november_2018 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_analytics:september_2017:*:*:*:*:*:*:* Versions september_2017 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_analytics:september_2018:*:*:*:*:*:*:* Versions september_2018 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_sense:april_2018:*:*:*:enterprise:*:*:* Versions april_2018 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_sense:february_2018:*:*:*:enterprise:*:*:* Versions february_2018 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_sense:february_2019:*:*:*:enterprise:*:*:* Versions february_2019 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_sense:june_2017:*:*:*:enterprise:*:*:* Versions june_2017 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_sense:june_2018:*:*:*:enterprise:*:*:* Versions june_2018 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_sense:november_2017:*:*:*:enterprise:*:*:* Versions november_2017 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_sense:november_2018:*:*:*:enterprise:*:*:* Versions november_2018 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_sense:september_2017:*:*:*:enterprise:*:*:* Versions september_2017 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_sense:september_2018:*:*:*:enterprise:*:*:* Versions september_2018 Vulnerable ·Qlik

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-11628
  2. 2026-10-03 Alias added: GHSA-5pxw-q4pw-rmwh

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences