Lucene search
HistoryNov 15, 2023 - 10:15 p.m.
CVE-2023-48365
cve-2023-48365
qlik sense enterprise
windows
remote code execution
unauthenticated
qb-21683
http headers
privilege escalation
patch
vulnerability
nvd
9.9 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
9.9 High
AI Score
Confidence
High
0.92 High
EPSS
Percentile
98.9%
Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attacker is able to elevate their privilege by tunneling HTTP requests, allowing them to execute HTTP requests on the backend server that hosts the repository application. The fixed versions are August 2023 Patch 2, May 2023 Patch 6, February 2023 Patch 10, November 2022 Patch 12, August 2022 Patch 14, May 2022 Patch 16, February 2022 Patch 15, and November 2021 Patch 17. NOTE: this issue exists because of an incomplete fix for CVE-2023-41265.
Affected configurations
Node
qlikqlik_senseMatchaugust_2022-enterprisewindows
ORqlikqlik_senseMatchaugust_2022patch_1enterprisewindows
ORqlikqlik_senseMatchaugust_2022patch_10enterprisewindows
ORqlikqlik_senseMatchaugust_2022patch_11enterprisewindows
ORqlikqlik_senseMatchaugust_2022patch_12enterprisewindows
ORqlikqlik_senseMatchaugust_2022patch_13enterprisewindows
ORqlikqlik_senseMatchaugust_2022patch_2enterprisewindows
ORqlikqlik_senseMatchaugust_2022patch_3enterprisewindows
ORqlikqlik_senseMatchaugust_2022patch_4enterprisewindows
ORqlikqlik_senseMatchaugust_2022patch_5enterprisewindows
ORqlikqlik_senseMatchaugust_2022patch_6enterprisewindows
ORqlikqlik_senseMatchaugust_2022patch_7enterprisewindows
ORqlikqlik_senseMatchaugust_2022patch_8enterprisewindows
ORqlikqlik_senseMatchaugust_2022patch_9enterprisewindows
ORqlikqlik_senseMatchaugust_2023-enterprisewindows
ORqlikqlik_senseMatchaugust_2023patch_1enterprisewindows
ORqlikqlik_senseMatchfebruary_2022-enterprisewindows
ORqlikqlik_senseMatchfebruary_2022patch_1enterprisewindows
ORqlikqlik_senseMatchfebruary_2022patch_10enterprisewindows
ORqlikqlik_senseMatchfebruary_2022patch_11enterprisewindows
ORqlikqlik_senseMatchfebruary_2022patch_12enterprisewindows
ORqlikqlik_senseMatchfebruary_2022patch_13enterprisewindows
ORqlikqlik_senseMatchfebruary_2022patch_14enterprisewindows
ORqlikqlik_senseMatchfebruary_2022patch_2enterprisewindows
ORqlikqlik_senseMatchfebruary_2022patch_3enterprisewindows
ORqlikqlik_senseMatchfebruary_2022patch_4enterprisewindows
ORqlikqlik_senseMatchfebruary_2022patch_5enterprisewindows
ORqlikqlik_senseMatchfebruary_2022patch_6enterprisewindows
ORqlikqlik_senseMatchfebruary_2022patch_7enterprisewindows
ORqlikqlik_senseMatchfebruary_2022patch_8enterprisewindows
ORqlikqlik_senseMatchfebruary_2022patch_9enterprisewindows
ORqlikqlik_senseMatchfebruary_2023-enterprisewindows
ORqlikqlik_senseMatchfebruary_2023patch_1enterprisewindows
ORqlikqlik_senseMatchfebruary_2023patch_2enterprisewindows
ORqlikqlik_senseMatchfebruary_2023patch_3enterprisewindows
ORqlikqlik_senseMatchfebruary_2023patch_4enterprisewindows
ORqlikqlik_senseMatchfebruary_2023patch_5enterprisewindows
ORqlikqlik_senseMatchfebruary_2023patch_6enterprisewindows
ORqlikqlik_senseMatchfebruary_2023patch_7enterprisewindows
ORqlikqlik_senseMatchfebruary_2023patch_8enterprisewindows
ORqlikqlik_senseMatchfebruary_2023patch_9enterprisewindows
ORqlikqlik_senseMatchmay_2022-enterprisewindows
ORqlikqlik_senseMatchmay_2022patch_1enterprisewindows
ORqlikqlik_senseMatchmay_2022patch_10enterprisewindows
ORqlikqlik_senseMatchmay_2022patch_11enterprisewindows
ORqlikqlik_senseMatchmay_2022patch_12enterprisewindows
ORqlikqlik_senseMatchmay_2022patch_13enterprisewindows
ORqlikqlik_senseMatchmay_2022patch_14enterprisewindows
ORqlikqlik_senseMatchmay_2022patch_15enterprisewindows
ORqlikqlik_senseMatchmay_2022patch_2enterprisewindows
ORqlikqlik_senseMatchmay_2022patch_3enterprisewindows
ORqlikqlik_senseMatchmay_2022patch_4enterprisewindows
ORqlikqlik_senseMatchmay_2022patch_5enterprisewindows
ORqlikqlik_senseMatchmay_2022patch_6enterprisewindows
ORqlikqlik_senseMatchmay_2022patch_7enterprisewindows
ORqlikqlik_senseMatchmay_2022patch_8enterprisewindows
ORqlikqlik_senseMatchmay_2022patch_9enterprisewindows
ORqlikqlik_senseMatchmay_2023-enterprisewindows
ORqlikqlik_senseMatchmay_2023patch_1enterprisewindows
ORqlikqlik_senseMatchmay_2023patch_2enterprisewindows
ORqlikqlik_senseMatchmay_2023patch_3enterprisewindows
ORqlikqlik_senseMatchmay_2023patch_4enterprisewindows
ORqlikqlik_senseMatchmay_2023patch_5enterprisewindows
ORqlikqlik_senseMatchnovember_2021-enterprisewindows
ORqlikqlik_senseMatchnovember_2021patch_1enterprisewindows
ORqlikqlik_senseMatchnovember_2021patch_10enterprisewindows
ORqlikqlik_senseMatchnovember_2021patch_11enterprisewindows
ORqlikqlik_senseMatchnovember_2021patch_12enterprisewindows
ORqlikqlik_senseMatchnovember_2021patch_13enterprisewindows
ORqlikqlik_senseMatchnovember_2021patch_14enterprisewindows
ORqlikqlik_senseMatchnovember_2021patch_15enterprisewindows
ORqlikqlik_senseMatchnovember_2021patch_16enterprisewindows
ORqlikqlik_senseMatchnovember_2021patch_2enterprisewindows
ORqlikqlik_senseMatchnovember_2021patch_3enterprisewindows
ORqlikqlik_senseMatchnovember_2021patch_4enterprisewindows
ORqlikqlik_senseMatchnovember_2021patch_5enterprisewindows
ORqlikqlik_senseMatchnovember_2021patch_6enterprisewindows
ORqlikqlik_senseMatchnovember_2021patch_7enterprisewindows
ORqlikqlik_senseMatchnovember_2021patch_8enterprisewindows
ORqlikqlik_senseMatchnovember_2021patch_9enterprisewindows
ORqlikqlik_senseMatchnovember_2022-enterprisewindows
ORqlikqlik_senseMatchnovember_2022patch_1enterprisewindows
ORqlikqlik_senseMatchnovember_2022patch_10enterprisewindows
ORqlikqlik_senseMatchnovember_2022patch_11enterprisewindows
ORqlikqlik_senseMatchnovember_2022patch_2enterprisewindows
ORqlikqlik_senseMatchnovember_2022patch_3enterprisewindows
ORqlikqlik_senseMatchnovember_2022patch_4enterprisewindows
ORqlikqlik_senseMatchnovember_2022patch_5enterprisewindows
ORqlikqlik_senseMatchnovember_2022patch_6enterprisewindows
ORqlikqlik_senseMatchnovember_2022patch_7enterprisewindows
ORqlikqlik_senseMatchnovember_2022patch_8enterprisewindows
ORqlikqlik_senseMatchnovember_2022patch_9enterprisewindows
Social References
More
Related
nvd
nvd
CVE-2023-48365
2023-11-15 22:15:28
CVE-2023-41265
2023-08-29 23:15:09
nessus
nessus
Qlik Sense Enterprise HTTP Tunneling RCE
2023-12-08 00:00:00
Qlik Sense Enterprise Multiple Vulnerabilities
2023-12-08 00:00:00
prion
prion
Input validation
2023-11-15 22:15:00
Cross site request forgery (csrf)
2023-08-29 23:15:00
cvelist
cvelist
CVE-2023-48365
2023-11-15 00:00:00
CVE-2023-41265
2023-08-29 00:00:00
thn
thn
cve
cve
CVE-2023-41265
2023-08-29 23:15:09
cisa_kev
cisa_kev
Qlik Sense HTTP Tunneling Vulnerability
2023-12-07 00:00:00
attackerkb
attackerkb
CVE-2023-41265
2023-08-29 00:00:00
nuclei
nuclei
Qlik Sense Enterprise - HTTP Request Smuggling
2023-12-13 15:36:37
9.9 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
9.9 High
AI Score
Confidence
High
0.92 High
EPSS
Percentile
98.9%
Related for CVE-2023-48365