High severity · published Apr 5, 2024
CVE-2024-29863
A race condition in the installer executable in Qlik Qlikview before versions May 2022 SR3 (12.70.20300) and May 2023 SR2 (12,80.20200) may allow an existing lower privileged user…
7.8
CVSS
0.4%
EPSS
No
On KEV
Description
A race condition in the installer executable in Qlik Qlikview before versions May 2022 SR3 (12.70.20300) and May 2023 SR2 (12,80.20200) may allow an existing lower privileged user to cause code to be executed in the context of a Windows Administrator.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QL
Qlikview · Qlik
12.70.20300; 12.80.20200 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-29863
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-29863
community.qlik.com
https://community.qlik.com/t5/Official-Support-Articles/High-Severity-Security-fix-for-QlikView-CVE-2024-29863/ta-p/2432661
More from Qlikview
7.8
CVE-2021-41989
Qlik QlikView through 12.60.20100.0 creates a Temporary File in a Directory with Insecure Permissions
5.4
CVE-2022-42248
QlikView 12.60.2 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the QvsViewClient functionality
–
CVE-2015-3623
XML external entity (XXE) vulnerability in QlikTech Qlikview before 11.20 SR12 allows remote attackers to conduct server-side request forgery (SSRF) attacks and read arbitrary…