CVE-2023-41266 Known ransomware use

Qlik Sense Path Traversal Vulnerability

Qlik — Sense

Added to KEV catalog: 7 December 2023
Federal remediation due date: 28 December 2023
Weakness classification (CWE): CWE-20

CISA Description

Qlik Sense contains a path traversal vulnerability that allows a remote, unauthenticated attacker to create an anonymous session by sending maliciously crafted HTTP requests. This anonymous session could allow the attacker to send further requests to unauthorized endpoints.

Required action

Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

Notes

https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801 ; https://nvd.nist.gov/vuln/detail/CVE-2023-41266

View on NVD View on MITRE CVE View full CISA catalog

More Qlik Vulnerabilities

CVE-2023-48365

Qlik Sense HTTP Tunneling Vulnerability

CVE-2023-41265

Qlik Sense HTTP Tunneling Vulnerability

Confirm Your Exposure

Is this vulnerability present in your environment?

CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.

Explore VAPT Services