Skip to main content
Announcements
Qlik Connect 2024! Seize endless possibilities! LEARN MORE

Critical Security fixes for Qlik Sense Enterprise for Windows (CVE-2023-48365)

100% helpful (1/1)
cancel
Showing results for 
Search instead for 
Did you mean: 
Sonja_Bauernfeind
Digital Support
Digital Support

Critical Security fixes for Qlik Sense Enterprise for Windows (CVE-2023-48365)

Last Update:

Dec 1, 2023 9:03:10 AM

Updated By:

Sonja_Bauernfeind

Created date:

Sep 20, 2023 10:24:46 AM

Executive Summary 

A security issue in Qlik Sense Enterprise for Windows has been identified, and patches have been made available. If successfully exploited, this vulnerability could lead to a compromise of the server running the Qlik Sense software, including unauthenticated remote code execution (RCE). This resolves an incomplete fix for CVE-2023-41265. 

This issue was identified and responsibly reported to Qlik by Adam Crosser and Thomas Hendrickson of Praetorian

Qlik has received reports that this vulnerability may be being used by malicious actors. Customers should confirm they have applied the necessary patches outlined in this bulletin. If there are additional questions, customers may log a case with Qlik Support. 

 

Affected Software 

All versions of Qlik Sense Enterprise for Windows prior to and including these releases are impacted: 

  • August 2023 Patch 1
  • May 2023 Patch 5
  • February 2023 Patch 9
  • November 2022 Patch 11
  • August 2022 Patch 13
  • May 2022 Patch 15
  • February 2022 Patch 14
  • November 2021 Patch 16

Severity Rating 

Using the CVSS V3.1 scoring system (https://nvd.nist.gov/vuln-metrics/cvss), Qlik rates this severity as critical.  

Vulnerability Details

CVE-2023-48365 (QB-21683) HTTP Tunneling vulnerability in Qlik Sense Enterprise for Windows

Severity: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N (9.6 Critical)

Due to improper validation of HTTP Headers a remote attacker is able to elevate their privilege by tunnelling HTTP requests, allowing them to execute HTTP requests on the backend server hosting the repository application. This resolves an incomplete fix for CVE-2023-41265.

Resolution 

Recommendation 

Customers should upgrade Qlik Sense Enterprise for Windows to a version containing fixes for these issues. Fixes are available for the following versions: 

  • November 2023 IR
  • August 2023 Patch 2
  • May 2023 Patch 6
  • February 2023 Patch 10
  • November 2022 Patch 12
  • August 2022 Patch 14
  • May 2022 Patch 16
  • February 2022 Patch 15
  • November 2021 Patch 17

These patches include the fixes for previous issues CVE-2023-41266 and CVE-2023-41265 (link). 

All Qlik software can be downloaded from our official Qlik Download page (customer login required).

 

Edit December 1st, 2023: Added November 2023 IR release to clarify it is not affected

Labels (1)
Comments
Sonja_Bauernfeind
Digital Support
Digital Support

For discussions and questions, comment directly on the related blog post.  We will be monitoring it. Thank you!

Version history
Last update:
‎2023-12-01 09:03 AM
Updated by: