CVE-2020-36994: QlikView FTP Server DoS Vulnerability

CVE-2020-36994 Overview

CVE-2020-36994 is a denial of service vulnerability affecting QlikView 12.50.20000.0. The vulnerability exists in the FTP server address input field, where improper input validation allows local attackers to crash the application by providing an excessively long input string. Specifically, pasting a 300-character buffer into the FTP server address field triggers an application crash, preventing normal functionality and disrupting business intelligence operations.

This vulnerability is classified as CWE-120 (Buffer Copy without Checking Size of Input), commonly known as a classic buffer overflow condition. While the attack requires local access and user interaction, it can effectively render the QlikView application unusable until restarted.

Critical Impact

Local attackers can crash QlikView applications by exploiting buffer overflow in the FTP server address field, causing denial of service and disrupting business intelligence workflows.

Affected Products

• QlikView 12.50.20000.0

Discovery Timeline

• 2026-01-29 - CVE CVE-2020-36994 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2020-36994

Vulnerability Analysis

The vulnerability stems from insufficient bounds checking in the FTP server address input field within QlikView. When processing user input, the application fails to properly validate the length of data entered into the FTP server address field before copying it to a fixed-size buffer. This classic buffer overflow condition (CWE-120) allows an attacker to overwrite adjacent memory locations by supplying input that exceeds the expected buffer size.

The attack requires local access to the system and user interaction, as the attacker must paste the malicious input into the application's FTP configuration interface. While this limits the attack surface, environments where multiple users share access to QlikView installations or where untrusted users have local access could be vulnerable to this denial of service attack.

Root Cause

The root cause is a buffer copy operation that does not check the size of input before writing to a destination buffer. When a user pastes a 300-character string into the FTP server address field, the application attempts to copy this data into a buffer that cannot accommodate the full input. This results in memory corruption that causes the application to crash. The lack of input length validation before the copy operation is the fundamental coding flaw that enables this vulnerability.

Attack Vector

The attack is performed locally and requires the following conditions:

1. The attacker must have local access to a system running QlikView 12.50.20000.0
2. The attacker must navigate to the FTP server configuration interface
3. A 300-character payload must be pasted into the FTP server address input field
4. The application crashes upon processing the oversized input

The exploit is straightforward and requires no special tools—only the ability to paste a long string into the vulnerable input field. Technical details and proof-of-concept information are available in the Exploit-DB #48732 entry.

Detection Methods for CVE-2020-36994

Indicators of Compromise

• Unexpected QlikView application crashes or termination events
• Windows Event Log entries indicating application faults in QlikView processes
• Crash dump files generated in the QlikView application directory
• User reports of application instability when configuring FTP settings

Detection Strategies

• Monitor Windows Application Event Logs for QlikView crash events with fault module information
• Implement application monitoring to detect repeated crashes of QlikView processes
• Use endpoint detection solutions to identify unusual application termination patterns
• Review system stability reports for recurring QlikView failures

Monitoring Recommendations

• Configure alerts for QlikView application crash events in centralized logging systems
• Track application restart frequency to identify potential exploitation attempts
• Monitor user activity logs for FTP configuration changes preceding crashes
• Implement SentinelOne endpoint protection with application crash monitoring capabilities

How to Mitigate CVE-2020-36994

Immediate Actions Required

• Upgrade QlikView to a patched version if available from the vendor
• Restrict local access to QlikView installations to trusted users only
• Implement application-level access controls to limit FTP configuration access
• Review the VulnCheck Advisory on QlikView for additional guidance

Patch Information

Organizations should contact Qlik directly through their official website to obtain information about patched versions that address this denial of service vulnerability. Review vendor security bulletins and upgrade to the latest supported version of QlikView that includes a fix for this buffer overflow condition.

Workarounds

• Limit user access to FTP server configuration functionality within QlikView
• Implement role-based access controls to restrict who can modify FTP settings
• Monitor and log all configuration changes to detect potential exploitation attempts
• Consider disabling FTP functionality if not required for business operations
• Deploy endpoint protection solutions capable of detecting application exploitation