← Volver a CVEs

CVE-2023-41266

HIGHCISA KEV

8.2

Descripcion

A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows an unauthenticated remote attacker to generate an anonymous session. This allows them to transmit HTTP requests to unauthorized endpoints. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.

Detalles CVE

Puntuacion CVSS v3.18.2

SeveridadHIGH

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosNONE

Interaccion usuarioNONE

Publicado8/29/2023

Ultima modificacion10/31/2025

Fuentekev

Avistamientos honeypot0

CISA KEV

VendedorQlik

ProductoSense

Nombre vulnerabilidadQlik Sense Path Traversal Vulnerability

Fecha inclusion KEV2023-12-07

Fecha limite remediacion2023-12-28

Uso en ransomwareKnown

Productos afectados

qlik:qlik_sense

Debilidades (CWE)

CWE-22CWE-22

Referencias

https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801(cve@mitre.org)

https://community.qlik.com/t5/Release-Notes/tkb-p/ReleaseNotes(cve@mitre.org)

https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801(af854a3a-2127-422b-91ae-364da2661108)

https://community.qlik.com/t5/Release-Notes/tkb-p/ReleaseNotes(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41266(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.