CVE-2020-36994: QlikView FTP DoS Vulnerability

CVE-2020-36994 Overview

CVE-2020-36994 is a denial of service vulnerability in QlikView 12.50.20000.0. The flaw resides in the FTP server address input field of the application. A local attacker can paste a 300-character buffer into the FTP server address field to crash the application. The vulnerability is classified under CWE-120 (Buffer Copy without Checking Size of Input). Successful exploitation prevents normal use of QlikView until the application is restarted. The attack requires local access and user interaction, limiting remote exposure.

Critical Impact
Local attackers with access to the QlikView interface can crash the application by submitting an oversized FTP server address, disrupting analytics workflows.

Affected Products

QlikView 12.50.20000.0
Qlik QlikView desktop client (FTP connector component)
Deployments exposing the FTP server address input field to untrusted users

Discovery Timeline

2026-01-29 - CVE-2020-36994 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2020-36994

Vulnerability Analysis

The vulnerability is a classic buffer-handling flaw in QlikView's FTP connector user interface. The FTP server address field accepts input without enforcing a maximum length before passing it to underlying processing routines. Submitting approximately 300 characters into this field triggers an unhandled condition that terminates the QlikView process.

The weakness maps to CWE-120, Buffer Copy without Checking Size of Input. While the public proof of concept only demonstrates a crash, buffer copy weaknesses of this class warrant caution against potential follow-on research into memory corruption.

The attack vector is local and requires user interaction. An attacker must have access to a running QlikView instance and the ability to paste content into the affected dialog. Confidentiality and integrity are not affected; only application availability is impacted.

Root Cause

The root cause is missing input length validation on the FTP server address parameter. QlikView does not truncate, reject, or safely handle input that exceeds the expected size for a hostname or IP address string. When the oversized string reaches downstream parsing logic, the process aborts.

Attack Vector

Exploitation requires a user to paste a 300-character string into the FTP server address input field within the QlikView client. The application crashes immediately, ending the active session and any unsaved work. The technique is documented in Exploit-DB #48732 and the VulnCheck Advisory for QlikView.

No verified code examples are available beyond the public proof of concept. The vulnerability is described in prose because the trigger is a simple oversized string rather than a structured payload.

Detection Methods for CVE-2020-36994

Indicators of Compromise

Unexpected termination of the Qv.exe process on workstations running QlikView 12.50.20000.0
Windows Application event log entries showing QlikView faulting modules immediately after user interaction with the FTP connector dialog
User reports of repeated QlikView crashes when configuring FTP data sources

Detection Strategies

Monitor process termination events for QlikView binaries followed by Windows Error Reporting (WerFault.exe) activity tied to the same parent session
Correlate crash dumps located under %LOCALAPPDATA%\CrashDumps with QlikView image names to identify exploitation attempts
Inspect endpoint telemetry for QlikView processes exiting with non-zero status codes within seconds of clipboard paste activity

Monitoring Recommendations

Enable Windows Error Reporting collection and forward Application Error events (Event ID 1000) referencing QlikView to a central log store
Track frequency of QlikView crashes per user and host to detect repeated triggering, which may indicate targeted disruption
Alert security operations when QlikView crash counts exceed a baseline threshold during business hours

How to Mitigate CVE-2020-36994

Immediate Actions Required

Inventory all systems running QlikView 12.50.20000.0 and identify users who interact with the FTP connector
Restrict access to QlikView desktop clients to trusted users only and remove the application from shared or kiosk endpoints
Contact Qlik support to confirm whether a fixed build is available for the affected version and request the latest QlikView release

Patch Information

No vendor advisory URL is listed in the NVD record. Administrators should consult the Qlik Official Website and the VulnCheck Advisory for QlikView for upgrade guidance. Upgrading beyond QlikView 12.50.20000.0 to a currently supported release is the recommended remediation path.

Workarounds

Avoid pasting untrusted content into the FTP server address field within QlikView dialogs
Configure FTP data sources through scripted load statements with vetted server addresses instead of interactive dialogs
Apply application allowlisting and least-privilege controls so untrusted users cannot interact with QlikView configuration dialogs
Save QlikView work frequently to limit data loss if the application is crashed by a malicious paste

bash

# Configuration example: enumerate QlikView versions across endpoints
Get-WmiObject -Class Win32_Product -Filter "Name LIKE '%QlikView%'" |
  Select-Object Name, Version, Vendor |
  Export-Csv -Path qlikview_inventory.csv -NoTypeInformation