How severe is CVE-2019-11628?

This vulnerability has a severity rating of MEDIUM with a CVSS score of 6.5 out of 10.

What type of vulnerability is CVE-2019-11628?

This is classified as CWE-917, which is a common weakness in software security.

CVE-2019-11628 - MEDIUM Severity | CVSS 6.5

Vulnerability Description

An issue was discovered in QlikView Server before 11.20 SR19, 12.00 and 12.10 before 12.10 SR11, 12.20 before SR9, and 12.30 before SR2; and Qlik Sense Enterprise and Qlik Analytics Platform installations that lack these patch levels: February 2018 Patch 4, April 2018 Patch 3, June 2018 Patch 3, September 2018 Patch 4, November 2018 Patch 4, or February 2019 Patch 2. An authenticated user may be able to bypass intended file-read restrictions via crafted Browser requests.

Related Vulnerabilities

CVE-2018-16621

HIGH

CVSS:7.2(High)

Sonatype Nexus Repository Manager before 3.14 allows Java Expression Language Injection.

CWE-9172018

CVE-2019-9041

HIGH

CVSS:7.2(High)

An issue was discovered in ZZZCMS zzzphp V1.6.1. In the inc/zzz_template.php file, the parserIfLabel() function's filtering is not strict, resulting in PHP code execution, as demonstrated by the if:as...

CWE-9172019

CVE-2020-7799

HIGH

CVSS:7.2(High)

An issue was discovered in FusionAuth before 1.11.0. An authenticated user, allowed to edit e-mail templates (Home -> Settings -> Email Templates) or themes (Home -> Settings -> Themes), can execute c...

CWE-9172020

CVE-2019-16469

HIGH

CVSS:7.5(High)

Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 have an expression language injection vulnerability. Successful exploitation could lead to sensitive information disclosure.

CWE-9172019

CVE-2019-5355

HIGH

CVSS:7.5(High)

A remote denial of service vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.

CWE-9172019

CVE-2020-26565

HIGH

CVSS:7.5(High)

ObjectPlanet Opinio before 7.14 allows Expression Language Injection via the admin/permissionList.do from parameter. This can be used to retrieve possibly sensitive serverInfo data.

CWE-9172020