Qlik Sense Management Console - IT Health Check - Information Disclosure Through Web Content

J1 — Wed, 27 Dec 2023 15:33:00 GMT

Hi!

When browsing the QMC, the following HTTP requests were highlighted as low risk observations by the IT health check team we contracted:

Testing identified web content which could be accessed by authenticated users, which disclosed potentially sensitive information regarding the technology stack in use, this information could aid an attacker throughout the information gathering phase of their attack.

/qrs/SQLDatabase/version?xrfkey=<Redacted>
1. This responds with the PostgreSQL version number.
/resources/autogenerated/product-info.js??<Redacted>
1. It can be observed that the server exposed details about the installed packages and their respective version.
/qrs/About?xrfkey=<Redacted>
1. It can be observed that the application was exposing details about the type of database in use and the database build version.

I was wondering if this can be mitigated somehow or if this is to be treated as just part of the QMC functionality and left as is.

topic Qlik Sense Management Console - IT Health Check - Information Disclosure Through Web Content in Management & Governance

Qlik Sense Management Console - IT Health Check - Information Disclosure Through Web Content