topic Re: Security vulnerabilities in Qlik Sense' AngularJS in App Development

Security vulnerabilities in Qlik Sense' AngularJS

vegard_bakke — Thu, 12 Apr 2018 15:20:03 GMT

Qlik Sense is using AngualrJS 1.5.8, which has four known security vulnerabilities:

* https://snyk.io/test/npm/angular/1.5.8?severity=high&severity=medium&severity=low‌

It mentions:

* Content security policy bypass

* Cross-site scripting (x2)

* JSONP callback attack

with Medium severity.

Does anyone know if Qlik Sense is also vulnerable to this attacks, or if Qlik has fixed them in their released version of AngularJS?

Cheers

Re: Security vulnerabilities in Qlik Sense' AngularJS

iue — Mon, 16 Apr 2018 14:52:11 GMT

Thanks for raising this question.

It is in our plans to update angularjs to a newer version.

Re: Security vulnerabilities in Qlik Sense' AngularJS

vegard_bakke — Mon, 16 Apr 2018 16:22:29 GMT

Hoping for June 2018 release, according to Qlik Support.

(There are a few backwards compatibility issues with the newer angular, apperently. )

Re: Security vulnerabilities in Qlik Sense' AngularJS

Anonymous — Tue, 21 Aug 2018 17:22:49 GMT

Any update on this? Doesn't look like AngularJS was upgraded in June 2018 release of Qlik Sense.

Re: Security vulnerabilities in Qlik Sense' AngularJS

iue — Thu, 23 Aug 2018 06:54:11 GMT

Kevin,

The September18-release will include an upgrade to AngularJS 1.6.9. Our plan is to continue to upgrade AngularJS, so we always are on the latest 1.X version. Next planned upgrade is 1.7.X.

Please let me know if you have other questions.

Thanks!

Re: Security vulnerabilities in Qlik Sense' AngularJS

nob-ruin — Wed, 09 Jan 2019 13:23:06 GMT

Does this vulnerability affect the desktop version?

Re: Security vulnerabilities in Qlik Sense' AngularJS

nob-ruin — Wed, 09 Jan 2019 13:23:35 GMT

Does this vulnerability affect the desktop version?

Re: Security vulnerabilities in Qlik Sense' AngularJS

vegard_bakke — Tue, 23 Apr 2019 14:33:22 GMT

Qlik Sense Server November 2018 is still using Angular 1.5.8. A bit of disappointment her.

Qlik Sense Desktop would most likely have the exact same versions of Angular, and vulnerabilities.

But the question is if it matters. Are there anyone else than yourself using your Sense Desktop?
The vulnerabilities are mainly cross-site-scripting attacks.