Read the docs
TI-2023-21870 Aliases CVE-2023-41265GHSA-h5r5-8fxj-m5cm

An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for…

Priority CRITICAL 100Exploited in the wildCWE-444Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows a remote attacker to elevate their privilege by tunneling HTTP requests in the raw HTTP request. This allows them to send requests that get executed by the backend server hosting the repository application. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.

Why it matters now

Exploitation Active In CISA KEV since 2023-12-07CISA due date 2023-12-28Known ransomware use
EPSS 0.88215 99th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 36

CPEVersionsRoleVendor
cpe:2.3:a:qlik:qlik_sense:august_2022:-:*:*:enterprise:windows:*:*august_2022VulnerableQlik
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_1:*:*:enterprise:windows:*:*august_2022 patch_1VulnerableQlik
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_10:*:*:enterprise:windows:*:*august_2022 patch_10VulnerableQlik
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_11:*:*:enterprise:windows:*:*august_2022 patch_11VulnerableQlik
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_12:*:*:enterprise:windows:*:*august_2022 patch_12VulnerableQlik
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_2:*:*:enterprise:windows:*:*august_2022 patch_2VulnerableQlik
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_3:*:*:enterprise:windows:*:*august_2022 patch_3VulnerableQlik
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_4:*:*:enterprise:windows:*:*august_2022 patch_4VulnerableQlik
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_5:*:*:enterprise:windows:*:*august_2022 patch_5VulnerableQlik
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_6:*:*:enterprise:windows:*:*august_2022 patch_6VulnerableQlik
  • cpe:2.3:a:qlik:qlik_sense:august_2022:-:*:*:enterprise:windows:*:* Versions august_2022 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_sense:august_2022:patch_1:*:*:enterprise:windows:*:* Versions august_2022 patch_1 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_sense:august_2022:patch_10:*:*:enterprise:windows:*:* Versions august_2022 patch_10 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_sense:august_2022:patch_11:*:*:enterprise:windows:*:* Versions august_2022 patch_11 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_sense:august_2022:patch_12:*:*:enterprise:windows:*:* Versions august_2022 patch_12 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_sense:august_2022:patch_2:*:*:enterprise:windows:*:* Versions august_2022 patch_2 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_sense:august_2022:patch_3:*:*:enterprise:windows:*:* Versions august_2022 patch_3 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_sense:august_2022:patch_4:*:*:enterprise:windows:*:* Versions august_2022 patch_4 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_sense:august_2022:patch_5:*:*:enterprise:windows:*:* Versions august_2022 patch_5 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_sense:august_2022:patch_6:*:*:enterprise:windows:*:* Versions august_2022 patch_6 Vulnerable ·Qlik
Show 26 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_7:*:*:enterprise:windows:*:*august_2022 patch_7VulnerableQlik
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_8:*:*:enterprise:windows:*:*august_2022 patch_8VulnerableQlik
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_9:*:*:enterprise:windows:*:*august_2022 patch_9VulnerableQlik
cpe:2.3:a:qlik:qlik_sense:february_2023:-:*:*:enterprise:windows:*:*february_2023VulnerableQlik
cpe:2.3:a:qlik:qlik_sense:february_2023:patch_1:*:*:enterprise:windows:*:*february_2023 patch_1VulnerableQlik
cpe:2.3:a:qlik:qlik_sense:february_2023:patch_2:*:*:enterprise:windows:*:*february_2023 patch_2VulnerableQlik
cpe:2.3:a:qlik:qlik_sense:february_2023:patch_3:*:*:enterprise:windows:*:*february_2023 patch_3VulnerableQlik
cpe:2.3:a:qlik:qlik_sense:february_2023:patch_4:*:*:enterprise:windows:*:*february_2023 patch_4VulnerableQlik
cpe:2.3:a:qlik:qlik_sense:february_2023:patch_5:*:*:enterprise:windows:*:*february_2023 patch_5VulnerableQlik
cpe:2.3:a:qlik:qlik_sense:february_2023:patch_6:*:*:enterprise:windows:*:*february_2023 patch_6VulnerableQlik
cpe:2.3:a:qlik:qlik_sense:february_2023:patch_7:*:*:enterprise:windows:*:*february_2023 patch_7VulnerableQlik
cpe:2.3:a:qlik:qlik_sense:may_2023:-:*:*:enterprise:windows:*:*may_2023VulnerableQlik
cpe:2.3:a:qlik:qlik_sense:may_2023:patch_1:*:*:enterprise:windows:*:*may_2023 patch_1VulnerableQlik
cpe:2.3:a:qlik:qlik_sense:may_2023:patch_2:*:*:enterprise:windows:*:*may_2023 patch_2VulnerableQlik
cpe:2.3:a:qlik:qlik_sense:may_2023:patch3:*:*:enterprise:windows:*:*may_2023 patch3VulnerableQlik
cpe:2.3:a:qlik:qlik_sense:november_2022:-:*:*:enterprise:windows:*:*november_2022VulnerableQlik
cpe:2.3:a:qlik:qlik_sense:november_2022:patch_1:*:*:enterprise:windows:*:*november_2022 patch_1VulnerableQlik
cpe:2.3:a:qlik:qlik_sense:november_2022:patch_10:*:*:enterprise:windows:*:*november_2022 patch_10VulnerableQlik
cpe:2.3:a:qlik:qlik_sense:november_2022:patch_2:*:*:enterprise:windows:*:*november_2022 patch_2VulnerableQlik
cpe:2.3:a:qlik:qlik_sense:november_2022:patch_3:*:*:enterprise:windows:*:*november_2022 patch_3VulnerableQlik
cpe:2.3:a:qlik:qlik_sense:november_2022:patch_4:*:*:enterprise:windows:*:*november_2022 patch_4VulnerableQlik
cpe:2.3:a:qlik:qlik_sense:november_2022:patch_5:*:*:enterprise:windows:*:*november_2022 patch_5VulnerableQlik
cpe:2.3:a:qlik:qlik_sense:november_2022:patch_6:*:*:enterprise:windows:*:*november_2022 patch_6VulnerableQlik
cpe:2.3:a:qlik:qlik_sense:november_2022:patch_7:*:*:enterprise:windows:*:*november_2022 patch_7VulnerableQlik
cpe:2.3:a:qlik:qlik_sense:november_2022:patch_8:*:*:enterprise:windows:*:*november_2022 patch_8VulnerableQlik
cpe:2.3:a:qlik:qlik_sense:november_2022:patch_9:*:*:enterprise:windows:*:*november_2022 patch_9VulnerableQlik
  • cpe:2.3:a:qlik:qlik_sense:august_2022:patch_7:*:*:enterprise:windows:*:* Versions august_2022 patch_7 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_sense:august_2022:patch_8:*:*:enterprise:windows:*:* Versions august_2022 patch_8 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_sense:august_2022:patch_9:*:*:enterprise:windows:*:* Versions august_2022 patch_9 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_sense:february_2023:-:*:*:enterprise:windows:*:* Versions february_2023 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_sense:february_2023:patch_1:*:*:enterprise:windows:*:* Versions february_2023 patch_1 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_sense:february_2023:patch_2:*:*:enterprise:windows:*:* Versions february_2023 patch_2 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_sense:february_2023:patch_3:*:*:enterprise:windows:*:* Versions february_2023 patch_3 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_sense:february_2023:patch_4:*:*:enterprise:windows:*:* Versions february_2023 patch_4 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_sense:february_2023:patch_5:*:*:enterprise:windows:*:* Versions february_2023 patch_5 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_sense:february_2023:patch_6:*:*:enterprise:windows:*:* Versions february_2023 patch_6 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_sense:february_2023:patch_7:*:*:enterprise:windows:*:* Versions february_2023 patch_7 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_sense:may_2023:-:*:*:enterprise:windows:*:* Versions may_2023 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_sense:may_2023:patch_1:*:*:enterprise:windows:*:* Versions may_2023 patch_1 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_sense:may_2023:patch_2:*:*:enterprise:windows:*:* Versions may_2023 patch_2 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_sense:may_2023:patch3:*:*:enterprise:windows:*:* Versions may_2023 patch3 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_sense:november_2022:-:*:*:enterprise:windows:*:* Versions november_2022 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_sense:november_2022:patch_1:*:*:enterprise:windows:*:* Versions november_2022 patch_1 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_sense:november_2022:patch_10:*:*:enterprise:windows:*:* Versions november_2022 patch_10 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_sense:november_2022:patch_2:*:*:enterprise:windows:*:* Versions november_2022 patch_2 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_sense:november_2022:patch_3:*:*:enterprise:windows:*:* Versions november_2022 patch_3 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_sense:november_2022:patch_4:*:*:enterprise:windows:*:* Versions november_2022 patch_4 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_sense:november_2022:patch_5:*:*:enterprise:windows:*:* Versions november_2022 patch_5 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_sense:november_2022:patch_6:*:*:enterprise:windows:*:* Versions november_2022 patch_6 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_sense:november_2022:patch_7:*:*:enterprise:windows:*:* Versions november_2022 patch_7 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_sense:november_2022:patch_8:*:*:enterprise:windows:*:* Versions november_2022 patch_8 Vulnerable ·Qlik
  • cpe:2.3:a:qlik:qlik_sense:november_2022:patch_9:*:*:enterprise:windows:*:* Versions november_2022 patch_9 Vulnerable ·Qlik

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2023-12-07 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2023-41265
  3. 2026-10-03 Alias added: GHSA-h5r5-8fxj-m5cm

References

Advisory 1

Other 1

  • TI-2023-26226 Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated… KEVCVSS 3.1CRITICAL 9.9
  • TI-2023-21871 A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions… KEVCVSS 3.1HIGH 8.2
  • TI-2025-37930 Qlik Sense Enterprise v14.212.13 was discovered to contain an information leak via the /dev-hub/ directory. CVSS 3.1HIGH 7.5
  • TI-2019-08701 An issue was discovered in QlikView Server before 11.20 SR19, 12.00 and 12.10 before… CVSS 3.0HIGH 8.2
  • TI-2022-00483 Qlik Sense Enterprise Domain User enumeration CVSS 3.1MEDIUM 5.3
  • TI-2021-14883 The GeoAnalytics feature in Qlik Sense April 2020 patch 4 allows SSRF. CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences