Vulnerabilites related to qlik - qlik_sense
Vulnerability from fkie_nvd
Published
2023-08-29 23:15
Modified
2024-11-29 14:36
Severity ?
8.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Summary
A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows an unauthenticated remote attacker to generate an anonymous session. This allows them to transmit HTTP requests to unauthorized endpoints. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | may_2023 | |
| qlik | qlik_sense | may_2023 | |
| qlik | qlik_sense | may_2023 | |
| qlik | qlik_sense | may_2023 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 |
{
"cisaActionDue": "2023-12-28",
"cisaExploitAdd": "2023-12-07",
"cisaRequiredAction": "Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.",
"cisaVulnerabilityName": "Qlik Sense Path Traversal Vulnerability",
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:-:*:*:enterprise:windows:*:*",
"matchCriteriaId": "41AEA1CA-D344-48DB-92D8-05D0EDC8487D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_1:*:*:enterprise:windows:*:*",
"matchCriteriaId": "FC12BB7A-366F-4EE2-AABF-19E83B5B9EC7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_10:*:*:enterprise:windows:*:*",
"matchCriteriaId": "5F601CFC-70D0-450B-AE49-058E6B887E15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_11:*:*:enterprise:windows:*:*",
"matchCriteriaId": "17E7F947-3322-46BB-9B89-689F1B792D89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_12:*:*:enterprise:windows:*:*",
"matchCriteriaId": "37AF6E89-73F0-49E8-82F4-08084A5EBE2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_2:*:*:enterprise:windows:*:*",
"matchCriteriaId": "E4C7CBBB-C6A0-460E-95DC-C1855826C7F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_3:*:*:enterprise:windows:*:*",
"matchCriteriaId": "BD491E32-270C-452B-AC1E-FB8F509B916E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_4:*:*:enterprise:windows:*:*",
"matchCriteriaId": "EDE2809B-4234-443E-9E6A-6B402D258617",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_5:*:*:enterprise:windows:*:*",
"matchCriteriaId": "155F0D6F-2E4A-40E7-9145-7D130334466B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_6:*:*:enterprise:windows:*:*",
"matchCriteriaId": "D733F495-E0EF-4F25-8532-2773415EFB8B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_7:*:*:enterprise:windows:*:*",
"matchCriteriaId": "578092D7-0F52-45C1-B7E2-FC5AF86AB8ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_8:*:*:enterprise:windows:*:*",
"matchCriteriaId": "1B3164BA-0BDB-41F9-B51C-4FB0489A125A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_9:*:*:enterprise:windows:*:*",
"matchCriteriaId": "E0D31C35-50DC-4CDF-AFD4-311EAF5BBBD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:-:*:*:enterprise:windows:*:*",
"matchCriteriaId": "95BBBA68-269F-4385-9D14-A736F2CD707E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_1:*:*:enterprise:windows:*:*",
"matchCriteriaId": "E6E1046C-35F4-451A-BFF1-2FC6EB01B547",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_2:*:*:enterprise:windows:*:*",
"matchCriteriaId": "D9AB037B-EE88-47CD-B387-42651CBAAFF9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_3:*:*:enterprise:windows:*:*",
"matchCriteriaId": "3D28B87A-B36A-428E-A93B-255CFD62036F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_4:*:*:enterprise:windows:*:*",
"matchCriteriaId": "9AD961D6-A315-493C-926F-1441E51C1742",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_5:*:*:enterprise:windows:*:*",
"matchCriteriaId": "1EFEBD77-7968-4649-8E9B-DAB24DC36E64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_6:*:*:enterprise:windows:*:*",
"matchCriteriaId": "E6D033E6-C022-4C6B-9EAC-95ABF6CA9BA6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_7:*:*:enterprise:windows:*:*",
"matchCriteriaId": "761B402F-4E98-46A4-A8E3-87F167CF01D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2023:-:*:*:enterprise:windows:*:*",
"matchCriteriaId": "9E7034FB-5E64-47AD-B4A4-8428474C48C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2023:patch_1:*:*:enterprise:windows:*:*",
"matchCriteriaId": "29158A06-3DE9-487B-9BC5-B4A690864F4F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2023:patch_2:*:*:enterprise:windows:*:*",
"matchCriteriaId": "272C2CFE-0D8E-46CE-92B6-2BA8658C951B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2023:patch3:*:*:enterprise:windows:*:*",
"matchCriteriaId": "039E4C03-89CA-4E77-8D79-39D22E85A299",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:-:*:*:enterprise:windows:*:*",
"matchCriteriaId": "72D56C24-9CEF-486B-8E46-6111D7B1676A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_1:*:*:enterprise:windows:*:*",
"matchCriteriaId": "338E52B2-AD7D-43F3-B707-E0E5976B269E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_10:*:*:enterprise:windows:*:*",
"matchCriteriaId": "D216C67A-F124-49F0-90EA-B0C8B663D760",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_2:*:*:enterprise:windows:*:*",
"matchCriteriaId": "FA68ADC7-9E20-4BD3-9235-6D76D4519512",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_3:*:*:enterprise:windows:*:*",
"matchCriteriaId": "B41A9B8C-FAD3-46F1-8973-DF1FA408064B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_4:*:*:enterprise:windows:*:*",
"matchCriteriaId": "EE23F5BD-579C-488D-965A-AE916C32976A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_5:*:*:enterprise:windows:*:*",
"matchCriteriaId": "E9C90120-93D1-43B0-B541-F07EB8FD44EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_6:*:*:enterprise:windows:*:*",
"matchCriteriaId": "450F236B-4673-403C-9E23-736C0ED92F6E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_7:*:*:enterprise:windows:*:*",
"matchCriteriaId": "D5E431DE-26E2-4DA2-AD0B-1479D0C95B98",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_8:*:*:enterprise:windows:*:*",
"matchCriteriaId": "0D6F6570-970B-4E49-9D92-65FAFCC71360",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_9:*:*:enterprise:windows:*:*",
"matchCriteriaId": "38116465-3485-44D3-9097-F2C821D8278F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows an unauthenticated remote attacker to generate an anonymous session. This allows them to transmit HTTP requests to unauthorized endpoints. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13."
},
{
"lang": "es",
"value": "Una vulnerabilidad de limitaci\u00f3n incorrecta de una ruta a un directorio restringido (path traversal) detectada en Qlik Sense Enterprise para Windows, para las versiones Mayo 2023 Parche 3 y anteriores, Febrero 2023 Parche 7 y anteriores, Noviembre 2022 Parche 10 y anteriores, y Agosto 2022 Parche 12 y anteriores, permite a un atacante remoto no autenticado generar una sesi\u00f3n an\u00f3nima. Esto le permite transmitir peticiones HTTP a endpoints no autorizados. Esto se ha corregido en la IR de Agosto de 2023, el Parche 4 de Mayo de 2023, el Parche 8 de febrero de 2023, el Parche 11 de Noviembre de 2022 y el Parche 13 de Agosto de 2022."
}
],
"id": "CVE-2023-41266",
"lastModified": "2024-11-29T14:36:05.433",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 4.2,
"source": "cve@mitre.org",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 2.5,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-08-29T23:15:09.380",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes"
],
"url": "https://community.qlik.com/t5/Release-Notes/tkb-p/ReleaseNotes"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes"
],
"url": "https://community.qlik.com/t5/Release-Notes/tkb-p/ReleaseNotes"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-02-21 18:15
Modified
2024-11-21 06:38
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Summary
A vulnerability in Qlik Sense Enterprise on Windows could allow an remote attacker to enumerate domain user accounts. An attacker could exploit this vulnerability by sending authentication requests to an affected system. A successful exploit could allow the attacker to compare the response time that are returned by the affected system to determine which accounts are valid user accounts. Affected systems are only vulnerable if they have LDAP configured.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| qlik | qlik_sense | * | |
| microsoft | windows | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:*:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "A11AF1D3-E82C-4C30-BD28-E1A0118D37D5",
"versionEndExcluding": "14.44.0",
"versionStartIncluding": "14.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in Qlik Sense Enterprise on Windows could allow an remote attacker to enumerate domain user accounts. An attacker could exploit this vulnerability by sending authentication requests to an affected system. A successful exploit could allow the attacker to compare the response time that are returned by the affected system to determine which accounts are valid user accounts. Affected systems are only vulnerable if they have LDAP configured."
},
{
"lang": "es",
"value": "Una vulnerabilidad en Qlik Sense Enterprise en Windows podr\u00eda permitir a un atacante remoto enumerar cuentas de usuario de dominio. Un atacante podr\u00eda explotar esta vulnerabilidad enviando solicitudes de autenticaci\u00f3n a un sistema afectado. Un exploit exitoso podr\u00eda permitir al atacante comparar el tiempo de respuesta que es devuelto por el sistema afectado para determinar qu\u00e9 cuentas son cuentas de usuario v\u00e1lidas. Los sistemas afectados s\u00f3lo son vulnerables si tienen LDAP configurado"
}
],
"id": "CVE-2022-0564",
"lastModified": "2024-11-21T06:38:55.657",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "csirt@divd.nl",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-02-21T18:15:08.873",
"references": [
{
"source": "csirt@divd.nl",
"tags": [
"Release Notes"
],
"url": "https://community.qlik.com/t5/Release-Notes/Qlik-Sense-Enterprise-on-Windows-November-2021-Initial-Release/ta-p/1856531"
},
{
"source": "csirt@divd.nl",
"tags": [
"Third Party Advisory"
],
"url": "https://csirt.divd.nl/CVE-2022-0564/"
},
{
"source": "csirt@divd.nl",
"tags": [
"Third Party Advisory"
],
"url": "https://csirt.divd.nl/DIVD-2021-00021/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes"
],
"url": "https://community.qlik.com/t5/Release-Notes/Qlik-Sense-Enterprise-on-Windows-November-2021-Initial-Release/ta-p/1856531"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://csirt.divd.nl/CVE-2022-0564/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://csirt.divd.nl/DIVD-2021-00021/"
}
],
"sourceIdentifier": "csirt@divd.nl",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-204"
}
],
"source": "csirt@divd.nl",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-203"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-08-29 23:15
Modified
2024-11-29 14:35
Severity ?
9.6 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
9.9 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
9.9 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Summary
An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows a remote attacker to elevate their privilege by tunneling HTTP requests in the raw HTTP request. This allows them to send requests that get executed by the backend server hosting the repository application. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | may_2023 | |
| qlik | qlik_sense | may_2023 | |
| qlik | qlik_sense | may_2023 | |
| qlik | qlik_sense | may_2023 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 |
{
"cisaActionDue": "2023-12-28",
"cisaExploitAdd": "2023-12-07",
"cisaRequiredAction": "Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.",
"cisaVulnerabilityName": "Qlik Sense HTTP Tunneling Vulnerability",
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:-:*:*:enterprise:windows:*:*",
"matchCriteriaId": "41AEA1CA-D344-48DB-92D8-05D0EDC8487D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_1:*:*:enterprise:windows:*:*",
"matchCriteriaId": "FC12BB7A-366F-4EE2-AABF-19E83B5B9EC7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_10:*:*:enterprise:windows:*:*",
"matchCriteriaId": "5F601CFC-70D0-450B-AE49-058E6B887E15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_11:*:*:enterprise:windows:*:*",
"matchCriteriaId": "17E7F947-3322-46BB-9B89-689F1B792D89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_12:*:*:enterprise:windows:*:*",
"matchCriteriaId": "37AF6E89-73F0-49E8-82F4-08084A5EBE2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_2:*:*:enterprise:windows:*:*",
"matchCriteriaId": "E4C7CBBB-C6A0-460E-95DC-C1855826C7F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_3:*:*:enterprise:windows:*:*",
"matchCriteriaId": "BD491E32-270C-452B-AC1E-FB8F509B916E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_4:*:*:enterprise:windows:*:*",
"matchCriteriaId": "EDE2809B-4234-443E-9E6A-6B402D258617",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_5:*:*:enterprise:windows:*:*",
"matchCriteriaId": "155F0D6F-2E4A-40E7-9145-7D130334466B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_6:*:*:enterprise:windows:*:*",
"matchCriteriaId": "D733F495-E0EF-4F25-8532-2773415EFB8B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_7:*:*:enterprise:windows:*:*",
"matchCriteriaId": "578092D7-0F52-45C1-B7E2-FC5AF86AB8ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_8:*:*:enterprise:windows:*:*",
"matchCriteriaId": "1B3164BA-0BDB-41F9-B51C-4FB0489A125A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_9:*:*:enterprise:windows:*:*",
"matchCriteriaId": "E0D31C35-50DC-4CDF-AFD4-311EAF5BBBD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:-:*:*:enterprise:windows:*:*",
"matchCriteriaId": "95BBBA68-269F-4385-9D14-A736F2CD707E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_1:*:*:enterprise:windows:*:*",
"matchCriteriaId": "E6E1046C-35F4-451A-BFF1-2FC6EB01B547",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_2:*:*:enterprise:windows:*:*",
"matchCriteriaId": "D9AB037B-EE88-47CD-B387-42651CBAAFF9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_3:*:*:enterprise:windows:*:*",
"matchCriteriaId": "3D28B87A-B36A-428E-A93B-255CFD62036F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_4:*:*:enterprise:windows:*:*",
"matchCriteriaId": "9AD961D6-A315-493C-926F-1441E51C1742",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_5:*:*:enterprise:windows:*:*",
"matchCriteriaId": "1EFEBD77-7968-4649-8E9B-DAB24DC36E64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_6:*:*:enterprise:windows:*:*",
"matchCriteriaId": "E6D033E6-C022-4C6B-9EAC-95ABF6CA9BA6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_7:*:*:enterprise:windows:*:*",
"matchCriteriaId": "761B402F-4E98-46A4-A8E3-87F167CF01D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2023:-:*:*:enterprise:windows:*:*",
"matchCriteriaId": "9E7034FB-5E64-47AD-B4A4-8428474C48C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2023:patch_1:*:*:enterprise:windows:*:*",
"matchCriteriaId": "29158A06-3DE9-487B-9BC5-B4A690864F4F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2023:patch_2:*:*:enterprise:windows:*:*",
"matchCriteriaId": "272C2CFE-0D8E-46CE-92B6-2BA8658C951B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2023:patch3:*:*:enterprise:windows:*:*",
"matchCriteriaId": "039E4C03-89CA-4E77-8D79-39D22E85A299",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:-:*:*:enterprise:windows:*:*",
"matchCriteriaId": "72D56C24-9CEF-486B-8E46-6111D7B1676A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_1:*:*:enterprise:windows:*:*",
"matchCriteriaId": "338E52B2-AD7D-43F3-B707-E0E5976B269E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_10:*:*:enterprise:windows:*:*",
"matchCriteriaId": "D216C67A-F124-49F0-90EA-B0C8B663D760",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_2:*:*:enterprise:windows:*:*",
"matchCriteriaId": "FA68ADC7-9E20-4BD3-9235-6D76D4519512",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_3:*:*:enterprise:windows:*:*",
"matchCriteriaId": "B41A9B8C-FAD3-46F1-8973-DF1FA408064B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_4:*:*:enterprise:windows:*:*",
"matchCriteriaId": "EE23F5BD-579C-488D-965A-AE916C32976A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_5:*:*:enterprise:windows:*:*",
"matchCriteriaId": "E9C90120-93D1-43B0-B541-F07EB8FD44EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_6:*:*:enterprise:windows:*:*",
"matchCriteriaId": "450F236B-4673-403C-9E23-736C0ED92F6E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_7:*:*:enterprise:windows:*:*",
"matchCriteriaId": "D5E431DE-26E2-4DA2-AD0B-1479D0C95B98",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_8:*:*:enterprise:windows:*:*",
"matchCriteriaId": "0D6F6570-970B-4E49-9D92-65FAFCC71360",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_9:*:*:enterprise:windows:*:*",
"matchCriteriaId": "38116465-3485-44D3-9097-F2C821D8278F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows a remote attacker to elevate their privilege by tunneling HTTP requests in the raw HTTP request. This allows them to send requests that get executed by the backend server hosting the repository application. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13."
},
{
"lang": "es",
"value": "Una vulnerabilidad de HTTP Request Tunneling detectada en Qlik Sense Enterprise para Windows, para las versiones Mayo 2023 Parche 3 y anteriores, Febrero 2023 Parche 7 y anteriores, Noviembre 2022 Parche 10 y anteriores, y Agosto 2022 Parche 12 y anteriores permite a un atacante remoto escalar privilegios tunelizando peticiones HTTP en la petici\u00f3n HTTP sin procesar. Esto le permite enviar peticiones que son ejecutadas por el servidor del backend que aloja la aplicaci\u00f3n de repositorio. Esto se soluciona en la versi\u00f3n Agosto de 2023 IR, Mayo de 2023 Parche 4, Febrero de 2023 Parche 8, Noviembre de 2022 Parche 11, y Agosto de 2022 Parche 13."
}
],
"id": "CVE-2023-41265",
"lastModified": "2024-11-29T14:35:25.510",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.1,
"impactScore": 5.8,
"source": "cve@mitre.org",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.1,
"impactScore": 6.0,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-08-29T23:15:09.170",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes"
],
"url": "https://community.qlik.com/t5/Release-Notes/tkb-p/ReleaseNotes"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes"
],
"url": "https://community.qlik.com/t5/Release-Notes/tkb-p/ReleaseNotes"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-444"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-05-01 03:29
Modified
2024-11-21 04:21
Severity ?
8.2 (High) - CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
6.5 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
6.5 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Summary
An issue was discovered in QlikView Server before 11.20 SR19, 12.00 and 12.10 before 12.10 SR11, 12.20 before SR9, and 12.30 before SR2; and Qlik Sense Enterprise and Qlik Analytics Platform installations that lack these patch levels: February 2018 Patch 4, April 2018 Patch 3, June 2018 Patch 3, September 2018 Patch 4, November 2018 Patch 4, or February 2019 Patch 2. An authenticated user may be able to bypass intended file-read restrictions via crafted Browser requests.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://qliksupport.force.com/articles/000069985 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://qliksupport.force.com/articles/000069985 | Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:11.20:service_release_1:*:*:*:*:*:*",
"matchCriteriaId": "70348E24-DF95-4A83-820D-5F3C13055AE5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:11.20:service_release_10:*:*:*:*:*:*",
"matchCriteriaId": "1FBE0588-1011-4616-AF13-5312CDC262F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:11.20:service_release_11:*:*:*:*:*:*",
"matchCriteriaId": "5C258DFA-C6E6-49F1-BE0F-4F1E78EF16B4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:11.20:service_release_12:*:*:*:*:*:*",
"matchCriteriaId": "9D625AA7-2063-45F1-873F-9FE8BD1AD127",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:11.20:service_release_13:*:*:*:*:*:*",
"matchCriteriaId": "ED61447C-30A7-4369-AAB9-AC48B7ECE44C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:11.20:service_release_14:*:*:*:*:*:*",
"matchCriteriaId": "DE8DEAE0-083D-472C-8C89-F6452CA07FA1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:11.20:service_release_15:*:*:*:*:*:*",
"matchCriteriaId": "CA3B6615-A5F6-4DC6-B43B-E3C7D1453D86",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:11.20:service_release_16:*:*:*:*:*:*",
"matchCriteriaId": "44A0F9B9-4169-45AB-A08D-0CD17AE9042E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:11.20:service_release_17:*:*:*:*:*:*",
"matchCriteriaId": "18CD5DDE-EE11-4D84-9830-22190C9D0BAC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:11.20:service_release_2:*:*:*:*:*:*",
"matchCriteriaId": "1E959F54-6B26-47D8-849E-B2D4309CE9FC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:11.20:service_release_3:*:*:*:*:*:*",
"matchCriteriaId": "804B8141-890B-49D3-AAF7-29B82DE458F4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:11.20:service_release_4:*:*:*:*:*:*",
"matchCriteriaId": "09765ABB-8EF3-48B8-A2CB-409574CDD491",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:11.20:service_release_5:*:*:*:*:*:*",
"matchCriteriaId": "CDEA544E-D63B-4797-8BDA-20B7B7BA6FC3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:11.20:service_release_6:*:*:*:*:*:*",
"matchCriteriaId": "843EA971-B23E-4FD9-892D-AB5857C1AE47",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:11.20:service_release_7:*:*:*:*:*:*",
"matchCriteriaId": "A11AC3DC-D026-4E43-9ADE-4E3BF0CC22EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:11.20:service_release_8:*:*:*:*:*:*",
"matchCriteriaId": "44E5CA6C-9991-485F-98A7-7873684175D9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:11.20:service_release_9:*:*:*:*:*:*",
"matchCriteriaId": "D72BC295-687D-49AE-AB08-7A54F81066FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:12.00:*:*:*:*:*:*:*",
"matchCriteriaId": "1EC12134-E1F6-411B-962C-EC0F733FE9A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:12.10:service_release_1:*:*:*:*:*:*",
"matchCriteriaId": "DE1C9243-C526-4495-85EE-9DFF39E3747E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:12.10:service_release_2:*:*:*:*:*:*",
"matchCriteriaId": "76806FB7-5A08-4208-990F-5A255F74C3E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:12.10:service_release_3:*:*:*:*:*:*",
"matchCriteriaId": "2C8950D8-E839-4A57-BA91-86CAA412FE79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:12.10:service_release_4:*:*:*:*:*:*",
"matchCriteriaId": "7F9C80CC-F74C-4FB8-946E-CB56C9EF1521",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:12.10:service_release_5:*:*:*:*:*:*",
"matchCriteriaId": "E2D58713-EDA5-49C5-92FB-F34292DED794",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:12.10:service_release_6:*:*:*:*:*:*",
"matchCriteriaId": "9DC4C1E3-401B-48DC-9E34-FB0805ADB1CC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:12.10:service_release_7:*:*:*:*:*:*",
"matchCriteriaId": "F51220EF-9CCB-4A52-8F8D-11A1141F2C21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:12.10:service_release_8:*:*:*:*:*:*",
"matchCriteriaId": "89E647FE-5A80-4455-AABA-F07B08A38641",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:12.10:service_release_9:*:*:*:*:*:*",
"matchCriteriaId": "CAF8B5BB-EA7C-4973-8095-5E8BDA6076D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:12.20:service_release_1:*:*:*:*:*:*",
"matchCriteriaId": "93B22D9A-4F9C-43A5-9C06-8102507FD4EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:12.20:service_release_2:*:*:*:*:*:*",
"matchCriteriaId": "580CD55F-DE41-41B4-AA0E-996E670C408F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:12.20:service_release_3:*:*:*:*:*:*",
"matchCriteriaId": "1532D2D2-F60B-4E75-89EF-706013FB3DBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:12.20:service_release_4:*:*:*:*:*:*",
"matchCriteriaId": "FE2C1342-1417-47FB-A4FB-FFAF66AC778F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:12.30:service_release_1:*:*:*:*:*:*",
"matchCriteriaId": "873637C6-ADFE-4A15-9D33-F8D1092755B0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:qlik:qlik_analytics:april_2018:*:*:*:*:*:*:*",
"matchCriteriaId": "0B18B725-BDC3-4D09-A394-357294899ADF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_analytics:february_2018:*:*:*:*:*:*:*",
"matchCriteriaId": "58B51434-6094-41A3-8A2A-8E6BEBCAFF8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_analytics:february_2019:*:*:*:*:*:*:*",
"matchCriteriaId": "52B01CFC-4052-47B3-AE3F-C35C6CB2420A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_analytics:june_2017:*:*:*:*:*:*:*",
"matchCriteriaId": "5A717032-F242-4FBC-B161-0468D93C62C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_analytics:june_2018:*:*:*:*:*:*:*",
"matchCriteriaId": "0090402D-58DF-4789-B58A-578B9F12AEAC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_analytics:november_2017:*:*:*:*:*:*:*",
"matchCriteriaId": "2BAE1CAC-960E-4D47-B51E-B059DDB0359D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_analytics:november_2018:*:*:*:*:*:*:*",
"matchCriteriaId": "4304015D-9F88-42BC-A47E-AE97B4E376EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_analytics:september_2017:*:*:*:*:*:*:*",
"matchCriteriaId": "04DAA0C1-C364-4569-8FA4-610CD1E36CED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_analytics:september_2018:*:*:*:*:*:*:*",
"matchCriteriaId": "FE495C90-D556-466D-AABF-5C63641A7B43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:april_2018:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "F70CE603-B271-4388-9807-C443356277B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2018:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "2CA0BCEC-51E6-485B-8149-2703E24249A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2019:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "A1C4A9DD-6B2D-400E-88B0-5D923CAC2118",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:june_2017:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "F12B37BF-9FC8-4FED-90A8-73553E7E517B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:june_2018:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "6DB72ED4-AD95-4A05-99B7-BA1C13565CA3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2017:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "AD584882-AF47-4219-BA91-0A6BD2120F3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2018:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "72BD1752-05AE-42CF-BA4E-1036A269C96D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:september_2017:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "CA72F3BE-791D-4D7B-925C-2B1E93319EA9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:september_2018:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "2B0543DF-9C64-4545-996E-6B5B572A52AA",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in QlikView Server before 11.20 SR19, 12.00 and 12.10 before 12.10 SR11, 12.20 before SR9, and 12.30 before SR2; and Qlik Sense Enterprise and Qlik Analytics Platform installations that lack these patch levels: February 2018 Patch 4, April 2018 Patch 3, June 2018 Patch 3, September 2018 Patch 4, November 2018 Patch 4, or February 2019 Patch 2. An authenticated user may be able to bypass intended file-read restrictions via crafted Browser requests."
},
{
"lang": "es",
"value": "Fue encontrado un problema en QlikView Server versi\u00f3n anterior a 11.20 SR19, versi\u00f3n 12.00 y versi\u00f3n 12.10 anterior a 12.10 SR11, versi\u00f3n 12.20 anterior a SR9 y versi\u00f3n 12.30 anterior a SR2; y Qlik Sense Enterprise y Qlik Analytics Platform, ya que se presentan instalaciones q carecen de estos niveles de path: febrero de 2018 path 4, abril de 2018 path 3, junio de 2018 path 3, septiembre de 2018 path 4, noviembre de 2018 path 4 o febrero de 2019 path 2. Un usuario identificado puede ser capaz de omitir las restricciones de lectura de archivos previstas por medio de petici\u00f3nes de navegador creadas."
}
],
"id": "CVE-2019-11628",
"lastModified": "2024-11-21T04:21:29.393",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.0"
},
"exploitabilityScore": 1.8,
"impactScore": 5.8,
"source": "cve@mitre.org",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-05-01T03:29:00.230",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://qliksupport.force.com/articles/000069985"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://qliksupport.force.com/articles/000069985"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-917"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-06-21 17:15
Modified
2024-11-21 06:14
Severity ?
Summary
The GeoAnalytics feature in Qlik Sense April 2020 patch 4 allows SSRF.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://www.cyberiskvision.com/advisory/ | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.cyberiskvision.com/advisory/ | Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| qlik | qlik_sense | april_2020 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:april_2020:patch4:*:*:*:*:*:*",
"matchCriteriaId": "3B7159A4-0AE1-4F36-9EFE-657EF2172988",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The GeoAnalytics feature in Qlik Sense April 2020 patch 4 allows SSRF."
},
{
"lang": "es",
"value": "La funci\u00f3n GeoAnalytics de Qlik Sense versi\u00f3n April 2020 patch 4, permite un ataque de tipo SSRF"
}
],
"id": "CVE-2021-36761",
"lastModified": "2024-11-21T06:14:02.287",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-06-21T17:15:08.073",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.cyberiskvision.com/advisory/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.cyberiskvision.com/advisory/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-918"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-11-15 22:15
Modified
2025-01-14 02:00
Severity ?
9.6 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
9.9 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
9.9 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Summary
Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attacker is able to elevate their privilege by tunneling HTTP requests, allowing them to execute HTTP requests on the backend server that hosts the repository application. The fixed versions are August 2023 Patch 2, May 2023 Patch 6, February 2023 Patch 10, November 2022 Patch 12, August 2022 Patch 14, May 2022 Patch 16, February 2022 Patch 15, and November 2021 Patch 17. NOTE: this issue exists because of an incomplete fix for CVE-2023-41265.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2023 | |
| qlik | qlik_sense | august_2023 | |
| qlik | qlik_sense | february_2022 | |
| qlik | qlik_sense | february_2022 | |
| qlik | qlik_sense | february_2022 | |
| qlik | qlik_sense | february_2022 | |
| qlik | qlik_sense | february_2022 | |
| qlik | qlik_sense | february_2022 | |
| qlik | qlik_sense | february_2022 | |
| qlik | qlik_sense | february_2022 | |
| qlik | qlik_sense | february_2022 | |
| qlik | qlik_sense | february_2022 | |
| qlik | qlik_sense | february_2022 | |
| qlik | qlik_sense | february_2022 | |
| qlik | qlik_sense | february_2022 | |
| qlik | qlik_sense | february_2022 | |
| qlik | qlik_sense | february_2022 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | may_2022 | |
| qlik | qlik_sense | may_2022 | |
| qlik | qlik_sense | may_2022 | |
| qlik | qlik_sense | may_2022 | |
| qlik | qlik_sense | may_2022 | |
| qlik | qlik_sense | may_2022 | |
| qlik | qlik_sense | may_2022 | |
| qlik | qlik_sense | may_2022 | |
| qlik | qlik_sense | may_2022 | |
| qlik | qlik_sense | may_2022 | |
| qlik | qlik_sense | may_2022 | |
| qlik | qlik_sense | may_2022 | |
| qlik | qlik_sense | may_2022 | |
| qlik | qlik_sense | may_2022 | |
| qlik | qlik_sense | may_2022 | |
| qlik | qlik_sense | may_2022 | |
| qlik | qlik_sense | may_2023 | |
| qlik | qlik_sense | may_2023 | |
| qlik | qlik_sense | may_2023 | |
| qlik | qlik_sense | may_2023 | |
| qlik | qlik_sense | may_2023 | |
| qlik | qlik_sense | may_2023 | |
| qlik | qlik_sense | november_2021 | |
| qlik | qlik_sense | november_2021 | |
| qlik | qlik_sense | november_2021 | |
| qlik | qlik_sense | november_2021 | |
| qlik | qlik_sense | november_2021 | |
| qlik | qlik_sense | november_2021 | |
| qlik | qlik_sense | november_2021 | |
| qlik | qlik_sense | november_2021 | |
| qlik | qlik_sense | november_2021 | |
| qlik | qlik_sense | november_2021 | |
| qlik | qlik_sense | november_2021 | |
| qlik | qlik_sense | november_2021 | |
| qlik | qlik_sense | november_2021 | |
| qlik | qlik_sense | november_2021 | |
| qlik | qlik_sense | november_2021 | |
| qlik | qlik_sense | november_2021 | |
| qlik | qlik_sense | november_2021 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 |
{
"cisaActionDue": "2025-02-03",
"cisaExploitAdd": "2025-01-13",
"cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
"cisaVulnerabilityName": "Qlik Sense HTTP Tunneling Vulnerability",
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:-:*:*:enterprise:windows:*:*",
"matchCriteriaId": "41AEA1CA-D344-48DB-92D8-05D0EDC8487D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_1:*:*:enterprise:windows:*:*",
"matchCriteriaId": "FC12BB7A-366F-4EE2-AABF-19E83B5B9EC7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_10:*:*:enterprise:windows:*:*",
"matchCriteriaId": "5F601CFC-70D0-450B-AE49-058E6B887E15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_11:*:*:enterprise:windows:*:*",
"matchCriteriaId": "17E7F947-3322-46BB-9B89-689F1B792D89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_12:*:*:enterprise:windows:*:*",
"matchCriteriaId": "37AF6E89-73F0-49E8-82F4-08084A5EBE2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_13:*:*:enterprise:windows:*:*",
"matchCriteriaId": "B633BE26-057C-403F-A4BB-270E1D709ADF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_2:*:*:enterprise:windows:*:*",
"matchCriteriaId": "E4C7CBBB-C6A0-460E-95DC-C1855826C7F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_3:*:*:enterprise:windows:*:*",
"matchCriteriaId": "BD491E32-270C-452B-AC1E-FB8F509B916E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_4:*:*:enterprise:windows:*:*",
"matchCriteriaId": "EDE2809B-4234-443E-9E6A-6B402D258617",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_5:*:*:enterprise:windows:*:*",
"matchCriteriaId": "155F0D6F-2E4A-40E7-9145-7D130334466B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_6:*:*:enterprise:windows:*:*",
"matchCriteriaId": "D733F495-E0EF-4F25-8532-2773415EFB8B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_7:*:*:enterprise:windows:*:*",
"matchCriteriaId": "578092D7-0F52-45C1-B7E2-FC5AF86AB8ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_8:*:*:enterprise:windows:*:*",
"matchCriteriaId": "1B3164BA-0BDB-41F9-B51C-4FB0489A125A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_9:*:*:enterprise:windows:*:*",
"matchCriteriaId": "E0D31C35-50DC-4CDF-AFD4-311EAF5BBBD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2023:-:*:*:enterprise:windows:*:*",
"matchCriteriaId": "34047E2B-26A8-46F4-A9FA-24E4C997AF58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2023:patch_1:*:*:enterprise:windows:*:*",
"matchCriteriaId": "3310512E-BDAA-46E4-925E-6BEF1E25417F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2022:-:*:*:enterprise:windows:*:*",
"matchCriteriaId": "24422FCB-D58E-4E00-A541-7557CFD9D30A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2022:patch_1:*:*:enterprise:windows:*:*",
"matchCriteriaId": "050A35DF-46A5-4327-8A13-07D1DD3E4F49",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2022:patch_10:*:*:enterprise:windows:*:*",
"matchCriteriaId": "8E1D08FE-49DA-41B2-B562-4CC50BF6C361",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2022:patch_11:*:*:enterprise:windows:*:*",
"matchCriteriaId": "2ED9A41B-9E76-4B6E-BDB5-FEE969DEAFDD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2022:patch_12:*:*:enterprise:windows:*:*",
"matchCriteriaId": "96E3A247-C5AD-4A84-855B-118386424087",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2022:patch_13:*:*:enterprise:windows:*:*",
"matchCriteriaId": "DDA98915-B4BA-4044-8404-2AFAB25EAA06",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2022:patch_14:*:*:enterprise:windows:*:*",
"matchCriteriaId": "F9DA8A45-9FEF-486E-AD6A-C5A9D15D0246",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2022:patch_2:*:*:enterprise:windows:*:*",
"matchCriteriaId": "AFCDA4AC-758E-4999-94B6-D3BA24F03BB1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2022:patch_3:*:*:enterprise:windows:*:*",
"matchCriteriaId": "83547AC9-E4E6-4FF9-94CE-DDB32BF1D41F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2022:patch_4:*:*:enterprise:windows:*:*",
"matchCriteriaId": "35881EDA-560B-4C5C-9388-EC44F4B89F83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2022:patch_5:*:*:enterprise:windows:*:*",
"matchCriteriaId": "C090D35D-6ED8-406A-AC58-6A79280F52A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2022:patch_6:*:*:enterprise:windows:*:*",
"matchCriteriaId": "39DF7548-666A-4903-8785-7CD7295DA6E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2022:patch_7:*:*:enterprise:windows:*:*",
"matchCriteriaId": "F8467611-FF63-4154-AC76-ED7A876A46CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2022:patch_8:*:*:enterprise:windows:*:*",
"matchCriteriaId": "B6D680D9-1049-4CA5-9AFD-1EC5C6B0DC5C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2022:patch_9:*:*:enterprise:windows:*:*",
"matchCriteriaId": "E721B224-0A35-4A9B-BD44-5B127FF1E6E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:-:*:*:enterprise:windows:*:*",
"matchCriteriaId": "95BBBA68-269F-4385-9D14-A736F2CD707E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_1:*:*:enterprise:windows:*:*",
"matchCriteriaId": "E6E1046C-35F4-451A-BFF1-2FC6EB01B547",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_2:*:*:enterprise:windows:*:*",
"matchCriteriaId": "D9AB037B-EE88-47CD-B387-42651CBAAFF9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_3:*:*:enterprise:windows:*:*",
"matchCriteriaId": "3D28B87A-B36A-428E-A93B-255CFD62036F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_4:*:*:enterprise:windows:*:*",
"matchCriteriaId": "9AD961D6-A315-493C-926F-1441E51C1742",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_5:*:*:enterprise:windows:*:*",
"matchCriteriaId": "1EFEBD77-7968-4649-8E9B-DAB24DC36E64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_6:*:*:enterprise:windows:*:*",
"matchCriteriaId": "E6D033E6-C022-4C6B-9EAC-95ABF6CA9BA6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_7:*:*:enterprise:windows:*:*",
"matchCriteriaId": "761B402F-4E98-46A4-A8E3-87F167CF01D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_8:*:*:enterprise:windows:*:*",
"matchCriteriaId": "5523F0D6-0017-4A1B-9A02-8108731DE05C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_9:*:*:enterprise:windows:*:*",
"matchCriteriaId": "5B1B9FCD-3499-4F0B-97FC-C693942FF0EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2022:-:*:*:enterprise:windows:*:*",
"matchCriteriaId": "12C6F742-F9E3-4F02-9610-B187E8DF9B61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2022:patch_1:*:*:enterprise:windows:*:*",
"matchCriteriaId": "9EE55EBA-35E6-4538-BA42-AB0AF18FBC78",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2022:patch_10:*:*:enterprise:windows:*:*",
"matchCriteriaId": "A32668D9-297C-443A-94BA-5EE404B56286",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2022:patch_11:*:*:enterprise:windows:*:*",
"matchCriteriaId": "4345AFA4-785C-4723-B7C5-0B1C74AFEB64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2022:patch_12:*:*:enterprise:windows:*:*",
"matchCriteriaId": "778E7986-3F4E-4AA0-BBBD-FB2C454B8170",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2022:patch_13:*:*:enterprise:windows:*:*",
"matchCriteriaId": "F8822B86-2222-47B4-AE4B-A0E43523DAAB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2022:patch_14:*:*:enterprise:windows:*:*",
"matchCriteriaId": "C8B23C50-2E46-4248-931F-CCFB6E96A115",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2022:patch_15:*:*:enterprise:windows:*:*",
"matchCriteriaId": "9C62E965-1663-419B-9C06-98655D4B0569",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2022:patch_2:*:*:enterprise:windows:*:*",
"matchCriteriaId": "E23565A3-34D2-40AA-8CB9-AB6EB4DDC776",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2022:patch_3:*:*:enterprise:windows:*:*",
"matchCriteriaId": "D2BCA144-1D99-48B4-B803-14049B14632B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2022:patch_4:*:*:enterprise:windows:*:*",
"matchCriteriaId": "64E043EC-C2A5-47C8-85BC-190607E7798C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2022:patch_5:*:*:enterprise:windows:*:*",
"matchCriteriaId": "035B8F10-67E0-4A73-863E-9A8C76C1EF9F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2022:patch_6:*:*:enterprise:windows:*:*",
"matchCriteriaId": "4B40BC46-2A7E-4019-A0B1-6D3981ECB002",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2022:patch_7:*:*:enterprise:windows:*:*",
"matchCriteriaId": "CA7C07E6-AFEB-4A9A-B9E7-D0EFE34B4DCC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2022:patch_8:*:*:enterprise:windows:*:*",
"matchCriteriaId": "C3DF6FC7-FB30-4A5C-A9E6-EB61DA00BB3A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2022:patch_9:*:*:enterprise:windows:*:*",
"matchCriteriaId": "12263319-ECAB-4AEA-B421-134A1816FF0C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2023:-:*:*:enterprise:windows:*:*",
"matchCriteriaId": "9E7034FB-5E64-47AD-B4A4-8428474C48C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2023:patch_1:*:*:enterprise:windows:*:*",
"matchCriteriaId": "29158A06-3DE9-487B-9BC5-B4A690864F4F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2023:patch_2:*:*:enterprise:windows:*:*",
"matchCriteriaId": "272C2CFE-0D8E-46CE-92B6-2BA8658C951B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2023:patch_3:*:*:enterprise:windows:*:*",
"matchCriteriaId": "91DBE33A-C764-46E7-A86C-8F39A19A3B82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2023:patch_4:*:*:enterprise:windows:*:*",
"matchCriteriaId": "BD48FE50-4825-461E-BE3F-7740B8A5EC7F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2023:patch_5:*:*:enterprise:windows:*:*",
"matchCriteriaId": "57E86313-0DDA-4FBA-89EF-CAAAD27A38CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2021:-:*:*:enterprise:windows:*:*",
"matchCriteriaId": "D8CB1637-AAF0-437A-A900-AA65D2D60299",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2021:patch_1:*:*:enterprise:windows:*:*",
"matchCriteriaId": "0EDF6498-65CF-4569-AA9B-03D0CB79421E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2021:patch_10:*:*:enterprise:windows:*:*",
"matchCriteriaId": "CB84D640-CAB6-4D91-9B24-B87F5FF07A26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2021:patch_11:*:*:enterprise:windows:*:*",
"matchCriteriaId": "C96EAA46-482D-4322-A226-AB5BE8F61276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2021:patch_12:*:*:enterprise:windows:*:*",
"matchCriteriaId": "A13C0501-7C14-4DFE-A3C4-941A479B5D7F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2021:patch_13:*:*:enterprise:windows:*:*",
"matchCriteriaId": "C687581D-C6C2-49C9-8A7D-F9BD6E7EEC77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2021:patch_14:*:*:enterprise:windows:*:*",
"matchCriteriaId": "CB16E82C-5C38-4364-B445-C30FBE429DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2021:patch_15:*:*:enterprise:windows:*:*",
"matchCriteriaId": "B4B3A235-231D-4993-9FE5-51B460C4A4D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2021:patch_16:*:*:enterprise:windows:*:*",
"matchCriteriaId": "DB79992D-7897-42C3-A628-BE64F3727795",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2021:patch_2:*:*:enterprise:windows:*:*",
"matchCriteriaId": "4F9774E8-B376-4644-9EBA-151453142014",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2021:patch_3:*:*:enterprise:windows:*:*",
"matchCriteriaId": "91B6C3BC-0492-4C1A-A790-B859EA0752FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2021:patch_4:*:*:enterprise:windows:*:*",
"matchCriteriaId": "C5BEF48B-C704-4B65-92C2-5373F29073AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2021:patch_5:*:*:enterprise:windows:*:*",
"matchCriteriaId": "D7B66038-D625-40D3-9E5A-E3076D796A47",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2021:patch_6:*:*:enterprise:windows:*:*",
"matchCriteriaId": "67ED13F8-B452-4F90-A492-7D4AEE36A4DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2021:patch_7:*:*:enterprise:windows:*:*",
"matchCriteriaId": "FD56699E-78F3-4FC4-B6A5-8D4759B53DBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2021:patch_8:*:*:enterprise:windows:*:*",
"matchCriteriaId": "235E44C4-2B84-48DE-A534-6081F3DFDE17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2021:patch_9:*:*:enterprise:windows:*:*",
"matchCriteriaId": "19F7DE12-3456-4BE2-92B3-00F29C7E07F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:-:*:*:enterprise:windows:*:*",
"matchCriteriaId": "72D56C24-9CEF-486B-8E46-6111D7B1676A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_1:*:*:enterprise:windows:*:*",
"matchCriteriaId": "338E52B2-AD7D-43F3-B707-E0E5976B269E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_10:*:*:enterprise:windows:*:*",
"matchCriteriaId": "D216C67A-F124-49F0-90EA-B0C8B663D760",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_11:*:*:enterprise:windows:*:*",
"matchCriteriaId": "81D4C015-A0D2-44E8-87B1-5CF790EFDBED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_2:*:*:enterprise:windows:*:*",
"matchCriteriaId": "FA68ADC7-9E20-4BD3-9235-6D76D4519512",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_3:*:*:enterprise:windows:*:*",
"matchCriteriaId": "B41A9B8C-FAD3-46F1-8973-DF1FA408064B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_4:*:*:enterprise:windows:*:*",
"matchCriteriaId": "EE23F5BD-579C-488D-965A-AE916C32976A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_5:*:*:enterprise:windows:*:*",
"matchCriteriaId": "E9C90120-93D1-43B0-B541-F07EB8FD44EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_6:*:*:enterprise:windows:*:*",
"matchCriteriaId": "450F236B-4673-403C-9E23-736C0ED92F6E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_7:*:*:enterprise:windows:*:*",
"matchCriteriaId": "D5E431DE-26E2-4DA2-AD0B-1479D0C95B98",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_8:*:*:enterprise:windows:*:*",
"matchCriteriaId": "0D6F6570-970B-4E49-9D92-65FAFCC71360",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_9:*:*:enterprise:windows:*:*",
"matchCriteriaId": "38116465-3485-44D3-9097-F2C821D8278F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attacker is able to elevate their privilege by tunneling HTTP requests, allowing them to execute HTTP requests on the backend server that hosts the repository application. The fixed versions are August 2023 Patch 2, May 2023 Patch 6, February 2023 Patch 10, November 2022 Patch 12, August 2022 Patch 14, May 2022 Patch 16, February 2022 Patch 15, and November 2021 Patch 17. NOTE: this issue exists because of an incomplete fix for CVE-2023-41265."
},
{
"lang": "es",
"value": "Qlik Sense Enterprise para Windows antes de agosto de 2023 El parche 2 permite la ejecuci\u00f3n remota de c\u00f3digo no autenticado, tambi\u00e9n conocido como QB-21683. Debido a una validaci\u00f3n inadecuada de los encabezados HTTP, un atacante remoto puede elevar su privilegio al canalizar las solicitudes HTTP, lo que le permite ejecutar solicitudes HTTP en el servidor backend que aloja la aplicaci\u00f3n del repositorio. Las versiones corregidas son el parche 2 de agosto de 2023, el parche 6 de mayo de 2023, el parche 10 de febrero de 2023, el parche 12 de noviembre de 2022, el parche 14 de agosto de 2022, el parche 16 de mayo de 2022, el parche 15 de febrero de 2022 y el parche 17 de noviembre de 2021. NOTA: este problema existe debido a una soluci\u00f3n incompleta para CVE-2023-41265."
}
],
"id": "CVE-2023-48365",
"lastModified": "2025-01-14T02:00:02.073",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.1,
"impactScore": 5.8,
"source": "cve@mitre.org",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.1,
"impactScore": 6.0,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-11-15T22:15:28.027",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/tac-p/2120510"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/tac-p/2120510"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-444"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-444"
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
}
cve-2022-0564
Vulnerability from cvelistv5
Published
2022-02-21 00:00
Modified
2024-08-06 12:32
Severity ?
EPSS score ?
Summary
A vulnerability in Qlik Sense Enterprise on Windows could allow an remote attacker to enumerate domain user accounts. An attacker could exploit this vulnerability by sending authentication requests to an affected system. A successful exploit could allow the attacker to compare the response time that are returned by the affected system to determine which accounts are valid user accounts. Affected systems are only vulnerable if they have LDAP configured.
References
| ▼ | URL | Tags |
|---|---|---|
| https://csirt.divd.nl/DIVD-2021-00021/ | third-party-advisory | |
| https://csirt.divd.nl/CVE-2022-0564/ | third-party-advisory | |
| https://community.qlik.com/t5/Release-Notes/Qlik-Sense-Enterprise-on-Windows-November-2021-Initial-Release/ta-p/1856531 | vendor-advisory |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Qlik Sense | Qlik Sense Enterprise on Windows |
Version: 14.x < 14.44.0 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T23:32:46.219Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"third-party-advisory",
"x_transferred"
],
"url": "https://csirt.divd.nl/DIVD-2021-00021/"
},
{
"tags": [
"third-party-advisory",
"x_transferred"
],
"url": "https://csirt.divd.nl/CVE-2022-0564/"
},
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://community.qlik.com/t5/Release-Notes/Qlik-Sense-Enterprise-on-Windows-November-2021-Initial-Release/ta-p/1856531"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Qlik Sense Enterprise on Windows",
"vendor": "Qlik Sense",
"versions": [
{
"lessThan": "14.44.0",
"status": "affected",
"version": "14.x",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "This issue was discovered by Hidde Smit of DIVD."
}
],
"datePublic": "2022-02-20T23:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability in Qlik Sense Enterprise on Windows could allow an remote attacker to enumerate domain user accounts. An attacker could exploit this vulnerability by sending authentication requests to an affected system. A successful exploit could allow the attacker to compare the response time that are returned by the affected system to determine which accounts are valid user accounts. Affected systems are only vulnerable if they have LDAP configured."
}
],
"value": "A vulnerability in Qlik Sense Enterprise on Windows could allow an remote attacker to enumerate domain user accounts. An attacker could exploit this vulnerability by sending authentication requests to an affected system. A successful exploit could allow the attacker to compare the response time that are returned by the affected system to determine which accounts are valid user accounts. Affected systems are only vulnerable if they have LDAP configured."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-204",
"description": "CWE-204: Observable Response Discrepancy",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-06T12:32:37.966Z",
"orgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
"shortName": "DIVD"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://csirt.divd.nl/DIVD-2021-00021/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://csirt.divd.nl/CVE-2022-0564/"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://community.qlik.com/t5/Release-Notes/Qlik-Sense-Enterprise-on-Windows-November-2021-Initial-Release/ta-p/1856531"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpdate Qlik Sense Enterprise on Windows to version 14.44.0 or higher.\u003c/p\u003e"
}
],
"value": "Update Qlik Sense Enterprise on Windows to version 14.44.0 or higher."
}
],
"source": {
"advisory": "DIVD-2021-00021",
"discovery": "INTERNAL"
},
"title": "Qlik Sense Enterprise Domain User enumeration",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eDisable internet-facing NTLM endpoints, e.g. internal_windows_authentication, to avoid domain enumeration.\u003c/p\u003e"
}
],
"value": "Disable internet-facing NTLM endpoints, e.g. internal_windows_authentication, to avoid domain enumeration."
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
}
}
},
"cveMetadata": {
"assignerOrgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
"assignerShortName": "DIVD",
"cveId": "CVE-2022-0564",
"datePublished": "2022-02-21T00:00:00",
"dateReserved": "2022-02-10T00:00:00",
"dateUpdated": "2024-08-06T12:32:37.966Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-41265
Vulnerability from cvelistv5
Published
2023-08-29 00:00
Modified
2024-08-02 18:54
Severity ?
EPSS score ?
Summary
An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows a remote attacker to elevate their privilege by tunneling HTTP requests in the raw HTTP request. This allows them to send requests that get executed by the backend server hosting the repository application. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.
References
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:qlik:qlik_sense:may_2023:-:*:*:enterprise:windows:*:*"
],
"defaultStatus": "unknown",
"product": "qlik_sense",
"vendor": "qlik",
"versions": [
{
"lessThanOrEqual": "may_2023",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:qlik:qlik_sense:february_2023:patch_7:*:*:enterprise:windows:*:*"
],
"defaultStatus": "unknown",
"product": "qlik_sense",
"vendor": "qlik",
"versions": [
{
"lessThanOrEqual": "february_2023",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:qlik:qlik_sense:august_2022:patch_12:*:*:enterprise:windows:*:*"
],
"defaultStatus": "unknown",
"product": "qlik_sense",
"vendor": "qlik",
"versions": [
{
"lessThanOrEqual": "august_2022",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-41265",
"options": [
{
"Exploitation": "Active"
},
{
"Automatable": "Yes"
},
{
"Technical Impact": "Total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-23T04:01:03.009998Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2023-12-07",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-41265"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:21:57.007Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:54:05.059Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://community.qlik.com/t5/Release-Notes/tkb-p/ReleaseNotes"
},
{
"tags": [
"x_transferred"
],
"url": "https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows a remote attacker to elevate their privilege by tunneling HTTP requests in the raw HTTP request. This allows them to send requests that get executed by the backend server hosting the repository application. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AC:L/AV:N/A:N/C:H/I:H/PR:L/S:C/UI:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-08-29T22:34:49.015293",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://community.qlik.com/t5/Release-Notes/tkb-p/ReleaseNotes"
},
{
"url": "https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-41265",
"datePublished": "2023-08-29T00:00:00",
"dateReserved": "2023-08-25T00:00:00",
"dateUpdated": "2024-08-02T18:54:05.059Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-36761
Vulnerability from cvelistv5
Published
2022-06-21 16:07
Modified
2024-08-04 01:01
Severity ?
EPSS score ?
Summary
The GeoAnalytics feature in Qlik Sense April 2020 patch 4 allows SSRF.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.cyberiskvision.com/advisory/ | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T01:01:59.307Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.cyberiskvision.com/advisory/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The GeoAnalytics feature in Qlik Sense April 2020 patch 4 allows SSRF."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-21T16:07:30",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.cyberiskvision.com/advisory/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-36761",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The GeoAnalytics feature in Qlik Sense April 2020 patch 4 allows SSRF."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cyberiskvision.com/advisory/",
"refsource": "MISC",
"url": "https://www.cyberiskvision.com/advisory/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-36761",
"datePublished": "2022-06-21T16:07:30",
"dateReserved": "2021-07-16T00:00:00",
"dateUpdated": "2024-08-04T01:01:59.307Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2019-11628
Vulnerability from cvelistv5
Published
2019-05-01 02:07
Modified
2024-08-04 22:55
Severity ?
EPSS score ?
Summary
An issue was discovered in QlikView Server before 11.20 SR19, 12.00 and 12.10 before 12.10 SR11, 12.20 before SR9, and 12.30 before SR2; and Qlik Sense Enterprise and Qlik Analytics Platform installations that lack these patch levels: February 2018 Patch 4, April 2018 Patch 3, June 2018 Patch 3, September 2018 Patch 4, November 2018 Patch 4, or February 2019 Patch 2. An authenticated user may be able to bypass intended file-read restrictions via crafted Browser requests.
References
| ▼ | URL | Tags |
|---|---|---|
| https://qliksupport.force.com/articles/000069985 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T22:55:41.045Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://qliksupport.force.com/articles/000069985"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in QlikView Server before 11.20 SR19, 12.00 and 12.10 before 12.10 SR11, 12.20 before SR9, and 12.30 before SR2; and Qlik Sense Enterprise and Qlik Analytics Platform installations that lack these patch levels: February 2018 Patch 4, April 2018 Patch 3, June 2018 Patch 3, September 2018 Patch 4, November 2018 Patch 4, or February 2019 Patch 2. An authenticated user may be able to bypass intended file-read restrictions via crafted Browser requests."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AC:H/AV:N/A:N/C:H/I:H/PR:L/S:C/UI:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-05-01T02:07:47",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://qliksupport.force.com/articles/000069985"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-11628",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in QlikView Server before 11.20 SR19, 12.00 and 12.10 before 12.10 SR11, 12.20 before SR9, and 12.30 before SR2; and Qlik Sense Enterprise and Qlik Analytics Platform installations that lack these patch levels: February 2018 Patch 4, April 2018 Patch 3, June 2018 Patch 3, September 2018 Patch 4, November 2018 Patch 4, or February 2019 Patch 2. An authenticated user may be able to bypass intended file-read restrictions via crafted Browser requests."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AC:H/AV:N/A:N/C:H/I:H/PR:L/S:C/UI:N",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://qliksupport.force.com/articles/000069985",
"refsource": "MISC",
"url": "https://qliksupport.force.com/articles/000069985"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-11628",
"datePublished": "2019-05-01T02:07:47",
"dateReserved": "2019-04-30T00:00:00",
"dateUpdated": "2024-08-04T22:55:41.045Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-41266
Vulnerability from cvelistv5
Published
2023-08-29 00:00
Modified
2024-08-02 18:54
Severity ?
EPSS score ?
Summary
A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows an unauthenticated remote attacker to generate an anonymous session. This allows them to transmit HTTP requests to unauthorized endpoints. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.
References
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:qlik:qlik_sense:august_2022:patch_12:*:*:enterprise:windows:*:*"
],
"defaultStatus": "unknown",
"product": "qlik_sense",
"vendor": "qlik",
"versions": [
{
"lessThanOrEqual": "august_2022",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:qlik:qlik_sense:may_2023:patch3:*:*:enterprise:windows:*:*"
],
"defaultStatus": "unknown",
"product": "qlik_sense",
"vendor": "qlik",
"versions": [
{
"lessThanOrEqual": "may_2023",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:qlik:qlik_sense:february_2023:patch_7:*:*:enterprise:windows:*:*"
],
"defaultStatus": "unknown",
"product": "qlik_sense",
"vendor": "qlik",
"versions": [
{
"lessThanOrEqual": "february_2023",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:qlik:qlik_sense:november_2022:patch_10:*:*:enterprise:windows:*:*"
],
"defaultStatus": "unknown",
"product": "qlik_sense",
"vendor": "qlik",
"versions": [
{
"lessThanOrEqual": "november_2022",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-41266",
"options": [
{
"Exploitation": "Active"
},
{
"Automatable": "Yes"
},
{
"Technical Impact": "Total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-23T04:01:03.822744Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2023-12-07",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-41266"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:21:33.640Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:54:04.991Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://community.qlik.com/t5/Release-Notes/tkb-p/ReleaseNotes"
},
{
"tags": [
"x_transferred"
],
"url": "https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows an unauthenticated remote attacker to generate an anonymous session. This allows them to transmit HTTP requests to unauthorized endpoints. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AC:L/AV:N/A:N/C:H/I:L/PR:N/S:U/UI:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-08-29T22:34:56.594187",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://community.qlik.com/t5/Release-Notes/tkb-p/ReleaseNotes"
},
{
"url": "https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-41266",
"datePublished": "2023-08-29T00:00:00",
"dateReserved": "2023-08-25T00:00:00",
"dateUpdated": "2024-08-02T18:54:04.991Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-48365
Vulnerability from cvelistv5
Published
2023-11-15 00:00
Modified
2025-01-13 17:20
Severity ?
EPSS score ?
Summary
Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attacker is able to elevate their privilege by tunneling HTTP requests, allowing them to execute HTTP requests on the backend server that hosts the repository application. The fixed versions are August 2023 Patch 2, May 2023 Patch 6, February 2023 Patch 10, November 2022 Patch 12, August 2022 Patch 14, May 2022 Patch 16, February 2022 Patch 15, and November 2021 Patch 17. NOTE: this issue exists because of an incomplete fix for CVE-2023-41265.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T21:30:34.616Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/tac-p/2120510"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-48365",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-13T15:33:34.009005Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2025-01-13",
"reference": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
},
"type": "kev"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444 Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-13T17:20:22.659Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"timeline": [
{
"lang": "en",
"time": "2025-01-13T00:00:00+00:00",
"value": "CVE-2023-48365 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attacker is able to elevate their privilege by tunneling HTTP requests, allowing them to execute HTTP requests on the backend server that hosts the repository application. The fixed versions are August 2023 Patch 2, May 2023 Patch 6, February 2023 Patch 10, November 2022 Patch 12, August 2022 Patch 14, May 2022 Patch 16, February 2022 Patch 15, and November 2021 Patch 17. NOTE: this issue exists because of an incomplete fix for CVE-2023-41265."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AC:L/AV:N/A:N/C:H/I:H/PR:L/S:C/UI:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-11-15T21:15:52.732093",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/tac-p/2120510"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-48365",
"datePublished": "2023-11-15T00:00:00",
"dateReserved": "2023-11-15T00:00:00",
"dateUpdated": "2025-01-13T17:20:22.659Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}