CVE-2023-48365
Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software.
Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attacker is able to elevate their privilege by tunneling HTTP requests, allowing them to execute HTTP requests on the backend server that hosts the repository application. The fixed versions are August 2023 Patch 2, May 2023 Patch 6, February 2023 Patch 10, November 2022 Patch 12, August 2022 Patch 14, May 2022 Patch 16, February 2022 Patch 15, and November 2021 Patch 17. NOTE: this issue exists because of an incomplete fix for CVE-2023-41265.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:NActively exploited and used by ransomware crews. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 632 days
- Ransomware
- Used in known ransomware campaigns
- CVSS
- 9.6 CRITICAL
- EPSS (30-day exploit probability)
- 47.7% · top 1% of all CVEs
- Weakness
- CWE-444
- Attack vector
- Network, remotely reachable
- 1.Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
- 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
- 5.Verify offline/immutable backups and segment the affected systems. This flaw is used for ransomware initial access.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.