Skip to main content
MAINTENANCE ALERT: Dec. 12th starting 9 AM CET. Community will be read-only. GET DETAILS

CVE-2021-44832 : Handling the log4shell vulnerability for Visibility

No ratings
Showing results for 
Search instead for 
Did you mean: 

CVE-2021-44832 : Handling the log4shell vulnerability for Visibility

Last Update:

Jan 9, 2022 11:58:56 PM

Updated By:


Qlik is providing these mitigation steps as a temporary measure. A patch will be provided and linked here; customers are advised to move to the patch as soon as it is available.



Mitigation - Visibility 7.3


  1. Download log4j 2.3.2 and extract it to temporary folder "PATH_TO_LOG4J_2_3_2"
  2. cd $VISIBILITY_HOME/java/lib/default
  3. rm log4j-1.2-api-2.3.jar log4j-api-2.3.jar log4j-core-2.3.jar
    (it's better to move the jars to a backup folder rather than remove them)
  4. Copy the jars from the temporary folder
    cp ~/PATH_TO_LOG4J_2_3_2/log4j-api-2.3.2.jar .
    cp ~/PATH_TO_LOG4J_2_3_2/log4j-core-2.3.2.jar .
    cp ~/PATH_TO_LOG4J_2_3_2/log4j-1.2-api-2.3.2.jar .

  5. Restart Visibility hdpcollector and hdpcataloger components


No other components are affected.


Qlik Visibility 

Contributor II
Contributor II

Qlik Visibility - CVE-2021-44228: Visibility-Client.jar file vulnerability

Looking for guidance on Security vulnerability noted:

The version of Apache Log4j on the remote host is 2.x < 2.3.1 / 2.4 < 2.12.3 / 2.13 < 2.15.0. It is, therefore, affected by a remote code execution vulnerability in the JDNI parser due to improper log validation. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands. Log4j 1.x, which reached its End of Life prior to 2016, comes with JMSAppender which will perform a JNDI lookup if enabled in Log4j's configuration file, hence customers should evaluate triggers in 1.x based on the risk that it is EOL and whether JNDI lookups are enabled. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The following paths are showing in our Security scan results:
Path:/opt/attunity/visibility/product/v7/java/lib/MapR/visibility-client.jar - Note: Installed version:2.3 and Fixed version:2.3.1
Path:/opt/attunity/visibility/product/v7/java/lib/CDH_5.10/visibility-client.jar - Note: Installed version:2.3 and Fixed version:2.3.1

Please advise on guidance.


Vikki Turner


Contributor II
Contributor II

Qlik Visibility - Spring Framework vulnerability CVE-2022-22965

Looking for guidance on Attunity Visibility software v7.3 impact for Spring Framework vulnerability CVE-2022-22965. PNC Security has requested remediation as per below:

Spring Framework contains a flaw in the CachedIntrospectionResults class in spring-beans/src/main/java/org/springframework/beans/ related to insecure introspection when using request parameter binding. This may allow a remote attacker to invoke arbitrary Java class methods and execute arbitrary code. 

I've found the reference in your support documentation for the subject CVE vulnerability but there is no mention of Qlik Visibility software. Would appreciate some help.


Operating System: Linux
Operating System Version: RHEL 7.9
Product Release: V7.3
Environment Type: Production

Thank you,
Vikki Turner


Hi @Vikki ,


Visibility is a retired product and is no longer supported




Version history
Last update:
‎2022-01-10 02:58 AM
Updated by: