CVE-2020-36994
Buffer Overflow in QlikView FTP Input Causes DoS Crash
Publication date: 2026-01-29
Last updated on: 2026-01-29
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| qlik | qlikview | 12.50.20000.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a denial of service (DoS) issue in QlikView version 12.50.20000.0. It occurs when a local attacker pastes a specially crafted 300-character buffer into the FTP server address input field. This causes the application to crash, preventing it from functioning normally. The problem arises due to improper input handling in the FTP Server Address field. [1]
How can this vulnerability impact me? :
The impact of this vulnerability is that an attacker with local access can cause the QlikView application to crash by pasting a crafted input into the FTP server address field. This results in a denial of service, disrupting normal application functionality and potentially halting business processes that rely on QlikView. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to reproduce the denial of service condition locally. Specifically, you can run a script to generate a 300-character buffer (e.g., a string of 300 'A's), copy it to the clipboard, and then paste it into the 'FTP Server Address' field in QlikView's 'Open FTP ...' dialog. If the application crashes upon pasting and attempting to connect, the vulnerability is present. The proof-of-concept involves using a Python script to create the buffer file and then manually pasting it into the application. There are no specific network commands since this is a local input vulnerability. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include avoiding pasting or entering excessively long input (such as 300-character buffers) into the FTP Server Address field in QlikView. Restrict user access to the application to trusted users only, and monitor for any crashes related to this input field. Since this is a local denial of service vulnerability, applying any available patches or updates from QlikView when released is recommended. Until a patch is available, user education and input validation controls are the best immediate measures. [1]