CVE-2023-41265

2023-08-2900:00:00

mitre

github.com

qlik sense enterprise

windows

http request tunneling

vulnerability

remote attack

privilege elevation

CVSS3

9.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

AI Score

6.8

Confidence

Low

EPSS

0.908

Percentile

98.9%

SSVC

Exploitation

Active

Automatable

Yes

Technical Impact

Total

JSON

An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows a remote attacker to elevate their privilege by tunneling HTTP requests in the raw HTTP request. This allows them to send requests that get executed by the backend server hosting the repository application. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:qlik:qlik_sense:may_2023:-:*:*:enterprise:windows:*:*"
    ],
    "vendor": "qlik",
    "product": "qlik_sense",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "may_2023"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_7:*:*:enterprise:windows:*:*"
    ],
    "vendor": "qlik",
    "product": "qlik_sense",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "february_2023"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_12:*:*:enterprise:windows:*:*"
    ],
    "vendor": "qlik",
    "product": "qlik_sense",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "august_2022"
      }
    ],
    "defaultStatus": "unknown"
  }
]