CVE-2015-3623 XML external entity (XXE) vulnerability in QlikTech Qlikview before 11.20 SR12 allows remote attackers to conduct server-side request forgery (SSRF) attacks and read arbitrary files via crafted XML da...
MediumCVSS 6.4
EPSS 15.8%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
XML external entity (XXE) vulnerability in QlikTech Qlikview before 11.20 SR12 allows remote attackers to conduct server-side request forgery (SSRF) attacks and read arbitrary files via crafted XML data in a request to AccessPoint.aspx.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| qlikview | <= 11.20 | No fix listed |
References
- packetstormsecurity.com exploit
- 20150908 [CVE-2015-3623] Qlikview blind XXE Security Vulnerability mailing-list
- 38118 exploit