CVE-2023-41266 KEV
8.2
HIGH · CVSS 3.1 · EPSS 84.8% (pctl 100)
Patch first
On CISA KEV — known exploited in the wild, due 2023-12-28.
Description
A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows an unauthenticated remote attacker to generate an anonymous session. This allows them to transmit HTTP requests to unauthorized endpoints. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.
Scoring
| CVSS | 8.2 (HIGH, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N |
| EPSS | 84.84% — more likely to be exploited than 100% of all CVEs |
| Weakness | CWE-22 |
| On CISA KEV | yes — remediate by 2023-12-28 |
| Public exploit | none known |
| Published | 2023-08-29 |
| Last modified | 2026-08-05 |
CISA KEV
| Name | Qlik Sense Path Traversal Vulnerability |
|---|---|
| Added | 2023-12-07 |
| Due | 2023-12-28 |
| Vendor / product | Qlik / Sense |
| Ransomware use | known |
Affected (1)
| Vendor | Product |
|---|---|
| qlik | qlik sense |
References
- https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801
- https://community.qlik.com/t5/Release-Notes/tkb-p/ReleaseNotes
- https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801
- https://community.qlik.com/t5/Release-Notes/tkb-p/ReleaseNotes
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41266
→ the Explorer · watch your stack · NVD