CVE-2023-48365

Name: CVE-2023-48365
Creator: NVD / NIST
Published: 2023-11-15T22:15:28.027+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

CRITICALCVSS 9.9/10Actively ExploitedEPSS 24.68%

Last modified Jun 17, 2026

CVE-2023-48365 is a critical-severity vulnerability rated 9.9/10 on the CVSS scale. Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attacker is able to elevate their privilege by tunneling HTTP requests, allowing them to execute HTTP requests on the backend server that hosts the repository application. CISA has confirmed active exploitation in the wild. EPSS estimates a 24.68% chance of exploitation in the next 30 days.

Description

Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attacker is able to elevate their privilege by tunneling HTTP requests, allowing them to execute HTTP requests on the backend server that hosts the repository application. The fixed versions are August 2023 Patch 2, May 2023 Patch 6, February 2023 Patch 10, November 2022 Patch 12, August 2022 Patch 14, May 2022 Patch 16, February 2022 Patch 15, and November 2021 Patch 17. NOTE: this issue exists because of an incomplete fix for CVE-2023-41265.

Metrics

CVSS 3.1

9.9/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS Probability

24.68%

97.6th percentile

Probability of exploitation in the next 30 days. Learn more

Exploitation Status

This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by Feb 3, 2025.

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Qlik	Qlik Sense	august_2022
Qlik	Qlik Sense	august_2023
Qlik	Qlik Sense	february_2022
Qlik	Qlik Sense	february_2023
Qlik	Qlik Sense	may_2022
Qlik	Qlik Sense	may_2023
Qlik	Qlik Sense	november_2021
Qlik	Qlik Sense	november_2022

References

Timeline

Published: Nov 15, 2023
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2023-48365?

How severe is CVE-2023-48365?

CVE-2023-48365 has a CVSS score of 9.9/10 (CRITICAL severity). The EPSS model estimates a 24.68% probability of exploitation in the next 30 days. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.

How do I fix CVE-2023-48365?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2023-48365?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST