CVE-2022-0564: 
Qlik Sense vulnerability analysis and mitigation

A vulnerability (CVE-2022-0564) was discovered in Qlik Sense Enterprise on Windows that could allow remote attackers to enumerate domain user accounts. The vulnerability was disclosed in February 2022 and affects systems with LDAP configured (NVD).

The vulnerability allows an attacker to enumerate domain user accounts by sending authentication requests to an affected system. The attack vector is network-based (AV:N) with low attack complexity (AC:L) and requires no privileges (PR:N) or user interaction (UI:N). The vulnerability has a CVSS v3.1 base score of 5.3 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (NVD).

A successful exploitation allows attackers to compare response times returned by the affected system to determine which accounts are valid user accounts. This information disclosure could be used as part of a larger attack campaign to identify valid user accounts in the domain (NVD).

The vulnerability was addressed in the Qlik Sense Enterprise on Windows November 2021 release. Organizations should update to this version or later to mitigate the vulnerability (Qlik Release Notes).