MEDIUM

CVE-2023-41266

Qlik Qlik Sense 2023-08-29 CVSS v3.1

CVSS

6.5

KEV

Description

A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows an unauthenticated remote attacker to generate an anonymous session. This allows them to transmit HTTP requests to unauthorized endpoints. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.

Summary dbcve.org

This is a path traversal vulnerability in Qlik Sense Enterprise for Windows that allows unauthenticated remote attackers to generate anonymous sessions and send HTTP requests to unauthorized endpoints. The vulnerability exists in multiple older patch versions across four release trains.

Mitigation

Apply the appropriate vendor patch: May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, or August 2022 Patch 13 (or August 2023 IR) depending on the current version deployed.

Weakness (CWE)

CWE-22 Path Traversal

EPSS Score

84.84%

Probability of exploitation in next 30 days

99.7th percentile

References

https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801 Vendor Advisory https://community.qlik.com/t5/Release-Notes/tkb-p/ReleaseNotes Release Notes https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41266 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE