QlikView: jQuery 3.4.1 Cross-site Scripting (XSS) vulnerability

[Daniele_Purrone]

Some QlikView versions are using jQuery 3.4.1 is affected by Cross-site Scripting (XSS) vulnerability that it solved in the 3.5

Environment

• QlikView, versions up to 12.50 (April 2020) SR2

Resolution

jQuery is updated to 3.5.1 in version April 2020 SR3

From the QlikView April 2020 SR3 Release Notes:

Cross-site scripting (XSS) vulnerability with jQuery 3.4.1 and below Jira issue ID: QV-20277 jQuery upgraded to version 3.5.1. This replaces the fix delivered in SR2 which was found to be insufficient.

Cause:

Third-party vulnerability