CISA KEV · Known exploitedCritical

CVE-2023-41265

Qlik Sense

An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows a remote attacker to elevate their privilege by tunneling HTTP requests in the raw HTTP request. This allows them to send requests that get executed by the backend server hosting the repository application. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.

CVSS: 9.9
EPSS: 84.5%
CISA KEV: Listed
Published: 2023.08.30

PRIORITY ASSESSMENT

Immediate review

CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.

Known exploitationConfirmed by CISA KEV

Exploit probability84.5%

Technical severityCVSS 9.9

Vulnerability overview

Affected product and versions

Product: Qlik Sense
Affected versions: august 2022, february 2023, may 2023, november 2022
Fixed versions: No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

CISA required action

Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

Due date: 2023.12.28

1
Identify
Confirm that Qlik Sense and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE: CWE-444
KEV added: 2023.12.07
Ransomware use: 확인됨