CVE-2023-41265 is a critical HTTP Request Tunneling vulnerability affecting Qlik Sense Enterprise for Windows in multiple versions. This flaw allows a remote attacker to elevate privileges by smuggling HTTP requests, which are then executed by the backend server, leading to potential full system compromise. With a CVSS score of 9.9 (CRITICAL), it requires low privileges and no user interaction, making it easily exploitable over the network. This vulnerability is actively exploited in the wild, including by ransomware campaigns like Cactus and Magnet Goblin, and has garnered significant community discussion and media coverage, with Nuclei templates available for detection.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
august_2022CPE matchmatch criteria | cpe:2.3:a:qlik:qlik_sense:august_2022:-:*:*:enterprise:windows:*:* | ||
august_2022CPE matchmatch criteria | cpe:2.3:a:qlik:qlik_sense:august_2022:patch_1:*:*:enterprise:windows:*:* | ||
august_2022CPE matchmatch criteria | cpe:2.3:a:qlik:qlik_sense:august_2022:patch_10:*:*:enterprise:windows:*:* | ||
august_2022CPE matchmatch criteria | cpe:2.3:a:qlik:qlik_sense:august_2022:patch_11:*:*:enterprise:windows:*:* | ||
august_2022CPE matchmatch criteria | cpe:2.3:a:qlik:qlik_sense:august_2022:patch_12:*:*:enterprise:windows:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 1.0 Bluesky, 0.5 Mastodon, and 1.6 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.