Vulnerability Details : CVE-2015-3623
XML external entity (XXE) vulnerability in QlikTech Qlikview before 11.20 SR12 allows remote attackers to conduct server-side request forgery (SSRF) attacks and read arbitrary files via crafted XML data in a request to AccessPoint.aspx.
Vulnerability category: XML external entity (XXE) injectionServer-side request forgery (SSRF)
Products affected by CVE-2015-3623
- cpe:2.3:a:qlik:qlikview:*:sr11:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2015-3623
4.90%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 93 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2015-3623
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.4
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:P/A:N |
10.0
|
4.9
|
NIST |
References for CVE-2015-3623
-
https://www.exploit-db.com/exploits/38118/
Qlikview 11.20 SR11 - Blind XML External Entity InjectionExploit
-
http://packetstormsecurity.com/files/133499/Qlikview-11.20-SR4-Blind-XXE-Injection.html
Qlikview 11.20 SR4 Blind XXE Injection ≈ Packet StormExploit
-
http://www.securityfocus.com/archive/1/536411/100/0/threaded
SecurityFocus
Jump to