CVE-2023-41265, CVE-2023-41266 & CVE-2023-48365: Multiple Vulnerabilities in Qlik Sense Enterprise Actively Exploited

[kamal0475]

Does the above vulnerabilities impact Qlik replicate or Qlik Enterprise manager.

Our organization currently use Qlik Replicate (2021.11.0.165), and Qlik Enterprise Manager (2021.11.0.198) for data replication and monitoring.
Our security team has identified that the below vulnerabilities are being actively exploited in what appears to be an active ransomware campaign.
CVE-2023-41265, CVE-2023-41266 & CVE-2023-48365: Multiple Vulnerabilities in Qlik Sense Enterprise Actively Exploited.
Can you please let us know if the above CVE have any impact to Qlik Replicate and QEM tool that we are currently using?

Fyi.. Our organization is planning to upgrade to latest version of Qlik Replicate and Qlik enterprise manager in the early next year. 

Thank you.

[Dana_Baldwin · Accepted solution]

Hi @kamal0475 

We checked internally and only Qlik Sense is impacted by these (CVE-2023-41265, CVE-2023-41266 & CVE-2023-48365), other Qlik products are not impacted.

Internal reference # 00128025

Thanks,

Dana

[ramazanerduran]

Hi Dana,

Is this answer still valid? Only vulnerability codes that Qlik Sense impacted by (CVE-2023-41265, CVE-2023-41266 & CVE-2023-48365) or is there any other nev code? 

An additional question, is there any site/document to watch vulnerability list that Qlik Sense impacted?

Thanks,

Ramazan

[Dana_Baldwin]

Hi @ramazanerduran 

I did a quick search and could not find support cases for products besides Qlik Sense but we would need to check with our internal support team who works directly with R & D to confirm. It would be surprising that no other products were affected before but that these older vulnerabilities could be introduced in newer versions, so I suspect not. We have no method of raising issues to them via this forum, can you please open a support case?

We don't have a page on the forum dedicated to vulnerabilities. If you would like to see that, please submit the idea directly to our Product Management team here: https://community.qlik.com/t5/Ideas/idb-p/qlik-ideas

Thanks,

Dana

[ramazanerduran]

Hi @Dana_Baldwin,

Thank you for your responses, currently I don't have a urgent situation to ask if the products effected. I just wonder if there is a page that include the vulnerabilities. I'll submit this idea.

Thanks,

Ramazan