CVE-2023-48365 Known ransomware use

Qlik Sense HTTP Tunneling Vulnerability

Qlik — Sense

Added to KEV catalog: 13 January 2025
Federal remediation due date: 3 February 2025
Weakness classification (CWE): CWE-444

CISA Description

Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes

https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/tac-p/2120510 ; https://nvd.nist.gov/vuln/detail/CVE-2023-48365

View on NVD View on MITRE CVE View full CISA catalog

More Qlik Vulnerabilities

CVE-2023-41266

Qlik Sense Path Traversal Vulnerability

CVE-2023-41265

Qlik Sense HTTP Tunneling Vulnerability

Confirm Your Exposure

Is this vulnerability present in your environment?

CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.

Explore VAPT Services