CVE-2023-48365
Last modified
CVE-2023-48365 is a critical-severity vulnerability rated 9.9/10 on the CVSS scale. Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attacker is able to elevate their privilege by tunneling HTTP requests, allowing them to execute HTTP requests on the backend server that hosts the repository application. CISA has confirmed active exploitation in the wild. EPSS estimates a 24.68% chance of exploitation in the next 30 days.
Description
Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attacker is able to elevate their privilege by tunneling HTTP requests, allowing them to execute HTTP requests on the backend server that hosts the repository application. The fixed versions are August 2023 Patch 2, May 2023 Patch 6, February 2023 Patch 10, November 2022 Patch 12, August 2022 Patch 14, May 2022 Patch 16, February 2022 Patch 15, and November 2021 Patch 17. NOTE: this issue exists because of an incomplete fix for CVE-2023-41265.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Exploitation Status
This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Qlik | Qlik Sense | august_2022 |
| Qlik | Qlik Sense | august_2023 |
| Qlik | Qlik Sense | february_2022 |
| Qlik | Qlik Sense | february_2023 |
| Qlik | Qlik Sense | may_2022 |
| Qlik | Qlik Sense | may_2023 |
| Qlik | Qlik Sense | november_2021 |
| Qlik | Qlik Sense | november_2022 |
References
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-48365US Government Resource
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2023-48365?
How severe is CVE-2023-48365?
How do I fix CVE-2023-48365?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-4836The WordPress File Sharing Plugin WordPress plugin before 2.…4.3
- CVE-2023-48360 in OpenHarmony v3.2.2 and prior versions allow a local atta…5.5
- CVE-2023-48361Improper initialization in firmware for some Intel(R) CSME m…4.6
- CVE-2023-48362XXE in the XML Format Plugin in Apache Drill version 1.19.0 …8.8
- CVE-2023-48363A vulnerability has been identified in OpenPCS 7 V9.1 (All v…6.5
- CVE-2023-48364A vulnerability has been identified in OpenPCS 7 V9.1 (All v…6.5
- CVE-2023-48366Race condition in some Intel(R) System Security Report and S…5.6
- CVE-2023-48368Improper input validation in Intel(R) Media SDK software all…5.5
- CVE-2023-48369Mattermost fails to limit the log size of server logs allowi…5.3
- CVE-2023-4837SmodBIP is vulnerable to Cross-Site Request Forgery, that co…8.8
- CVE-2023-48371ITPison OMICARD EDM’s file uploading function does not restr…9.8
- CVE-2023-48372ITPison OMICARD EDM 's SMS-related function has insufficient…9.8
Are you affected by CVE-2023-48365?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST