CVE-2023-48365

Description

Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attacker is able to elevate their privilege by tunneling HTTP requests, allowing them to execute HTTP requests on the backend server that hosts the repository application. The fixed versions are August 2023 Patch 2, May 2023 Patch 6, February 2023 Patch 10, November 2022 Patch 12, August 2022 Patch 14, May 2022 Patch 16, February 2022 Patch 15, and November 2021 Patch 17. NOTE: this issue exists because of an incomplete fix for CVE-2023-41265.

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

• 9.6CVSS 3.1, Criticalfrom the CNA (mitre)CVSS:3.1/AC:L/AV:N/A:N/C:H/I:H/PR:L/S:C/UI:N

What to do

• Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.CISA KEV required action

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

No separately sourced impact summary is available on this page yet. Consult the description, version data and dated exploitation evidence.

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

Timeline

1. 15 Nov 2023 Published
2. 13 Jan 2025 CVE-2023-48365 added to CISA KEV
3. 13 Jan 2025 Added to the CISA KEV catalogue

Weakness

• CWE-444

References

• community.qlik.com