CVE-2022-42248

29th percentile - higher than 29% of all known CVEs

QlikView 12.60.2 was found to have a stored cross-site scripting (XSS) vulnerability in the QvsViewClient functionality. This allows an attacker to inject a malicious script that is stored on the server and executed in other users' browsers.

The risk includes session hijacking, account takeover, and theft of sensitive business data. The attack can be leveraged for privilege escalation within the QlikView environment.

Immediately upgrade QlikView to a version later than 12.60.2 that includes the fix. Also train administrators on secure configuration of the QvsViewClient feature.