CVE-2023-48365

Published Nov 15, 2023

Last updated a month ago

Overview

Description
Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attacker is able to elevate their privilege by tunneling HTTP requests, allowing them to execute HTTP requests on the backend server that hosts the repository application. The fixed versions are August 2023 Patch 2, May 2023 Patch 6, February 2023 Patch 10, November 2022 Patch 12, August 2022 Patch 14, May 2022 Patch 16, February 2022 Patch 15, and November 2021 Patch 17. NOTE: this issue exists because of an incomplete fix for CVE-2023-41265.
Source
cve@mitre.org
NVD status
Analyzed

Risk scores

CVSS 3.1

Type
Primary
Base score
9.9
Impact score
6
Exploitability score
3.1
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Severity
CRITICAL

Known exploits

Data from CISA

Vulnerability name
Qlik Sense HTTP Tunneling Vulnerability
Exploit added on
Jan 13, 2025
Exploit action due
Feb 3, 2025
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Weaknesses

nvd@nist.gov
CWE-444
134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE-444

Social media

Hype score
Not currently trending
  1. 米国サイバーセキュリティ・社会基盤安全保障庁(CISA)の既知の悪用された脆弱性カタログで、Qlik SenseのHTTPトンネリング脆弱性CVE-2023-48365の悪用が確認されたと更新。 https://t.co/2s6PEeDwzn

    @__kokumoto

    18 Mar 2025

    675 Impressions

    0 Retweets

    3 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. 🚨 Critical vulnerability CVE-2023-48365 in Qlik Sense Enterprise for Windows is being actively exploited. Censys has identified 11,185 exposed Qlik Sense instances online. Ensure your systems are patched to the latest versions to mitigate this risk.

    @censysio

    15 Jan 2025

    909 Impressions

    1 Retweet

    7 Likes

    2 Bookmarks

    0 Replies

    1 Quote

  3. CVE-2023-48365 alert 🚨(CVSS: 9.6/10) Qlik Sense Enterprise for Windows (pre-Aug 2023 Patch 2) allows unauthenticated RCE due to improper HTTP header validation (QB-21683). Fixed in Aug 2023 Patch 2 & earlier patches. Update now! 🔒 Our customers assets are protected. 🦉 h

    @Patrowl_io

    15 Jan 2025

    92 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. 米国サイバーセキュリティ・社会基盤安全保障庁(CISA)が既知の悪用された脆弱性カタログに2件の追加。なおメールとWebでの周知は失念している模様。 BeyondTrust PRA&RSのコマンドインジェクションCVE-2024-12686とQlik SenseのHTTPトンネリングCVE-2023-48365。対処期限は通常の2/3。ランサムウェア… https://t.co/IdIVOpGuJg https://t.co/C9k7HtOjCp

    @__kokumoto

    14 Jan 2025

    1108 Impressions

    0 Retweets

    2 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  5. CISA KEV Catalog Update Part III- January 2025 #CISAKEV #CVE-2024-12686 #CVE-2023-48365 https://t.co/zoEX97JFQ7

    @pravin_karthik

    14 Jan 2025

    45 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  6. CVE-2023-48365 (CVSS score of 9.6) is a Qlik Sense HTTP Tunneling Vulnerability. The HTTP tunneling vulnerability enables attackers to escalate privileges and send HTTP requests to the backend server. https://t.co/YVPgbuoHn9

    @InfoSecZac

    13 Jan 2025

    83 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  7. Latest Known Exploited Vulnerabilities (#KEV) : #CVE-2023-48365 #Qlik #Sense HTTP Tunneling Vulnerability https://t.co/4i49JsMCoz

    @ScyScan

    13 Jan 2025

    19 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  8. 🛡️ We added #QlikSense and #BeyondTrust vulnerabilities, CVE-2023-48365 & CVE-2024-12686, to our Known Exploited Vulnerabilities Catalog. Visit https://t.co/dOIn6I9vuB & apply mitigations to protect your org from cyberattacks. #Cybersecurity https://t.co/3gKRFE9Haw

    @CISACyber

    13 Jan 2025

    6005 Impressions

    38 Retweets

    70 Likes

    6 Bookmarks

    3 Replies

    5 Quotes

Configurations