CVE-2023-48365: Qlik Sense HTTP Tunneling Vulnerability

CVE-2023-48365 · Severity: critical · CVSS 9.9 · Exploited in the wild · Published 2025-01-13

Qlik Sense Enterprise for Windows contains an HTTP tunneling vulnerability due to improper validation of HTTP headers. An unauthenticated remote attacker can escalate privileges and execute HTTP requests on the backend repository application server, potentially leading to remote code execution. This issue is an incomplete fix for CVE-2023-41265.

Technologies: Qlik Sense. Vendors: Qlik.

Quick answers

Is CVE-2023-48365 exploited in the wild?
Yes. CVE-2023-48365 is known to be exploited in the wild, first recorded on 13 January 2025. Treat it as urgent.
How severe is CVE-2023-48365?
Critical severity, with a CVSS score of 9.9, published 13 January 2025.
Which products and versions are affected?
Qlik Qlik Sense Enterprise for Windows Before August 2023 Patch 2; May 2023 before Patch 6; February 2023 before Patch 10; November 2022 before Patch 12; August 2022 before Patch 14; May 2022 before Patch 16; February 2022 before Patch 15; November 2021 before Patch 17.
Is there a fix for CVE-2023-48365?
A patch was published on 2023-08-30: Vendor released patches across multiple versions (August 2023 Patch 2 and others) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-48365 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2023-48365?
Check whether you run Qlik Sense. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Affected products

  • Qlik Qlik Sense Enterprise for Windows Before August 2023 Patch 2; May 2023 before Patch 6; February 2023 before Patch 10; November 2022 before Patch 12; August 2022 before Patch 14; May 2022 before Patch 16; February 2022 before Patch 15; November 2021 before Patch 17

Timeline

  • 2023-11-29: disclosed: Initial NVD analysis date
  • 2025-01-13: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
  • 2025-01-13: advisory: Publication date of the advisory
  • 2023-08-30: patched: Vendor released patches across multiple versions (August 2023 Patch 2 and others)
  • 2025-01-13: exploited: Reported as exploited in the wild via CISA KEV catalog entry

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.