A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions…
Priority CRITICAL 95Exploited in the wildCWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows an unauthenticated remote attacker to generate an anonymous session. This allows them to transmit HTTP requests to unauthorized endpoints. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.
Why it matters now
Exploitation Active In CISA KEV since 2023-12-07CISA due date 2023-12-28Known ransomware use
EPSS 0.84843 99th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 36
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:qlik:qlik_sense:august_2022:-:*:*:enterprise:windows:*:* | august_2022 | Vulnerable | Qlik |
| cpe:2.3:a:qlik:qlik_sense:august_2022:patch_1:*:*:enterprise:windows:*:* | august_2022 patch_1 | Vulnerable | Qlik |
| cpe:2.3:a:qlik:qlik_sense:august_2022:patch_10:*:*:enterprise:windows:*:* | august_2022 patch_10 | Vulnerable | Qlik |
| cpe:2.3:a:qlik:qlik_sense:august_2022:patch_11:*:*:enterprise:windows:*:* | august_2022 patch_11 | Vulnerable | Qlik |
| cpe:2.3:a:qlik:qlik_sense:august_2022:patch_12:*:*:enterprise:windows:*:* | august_2022 patch_12 | Vulnerable | Qlik |
| cpe:2.3:a:qlik:qlik_sense:august_2022:patch_2:*:*:enterprise:windows:*:* | august_2022 patch_2 | Vulnerable | Qlik |
| cpe:2.3:a:qlik:qlik_sense:august_2022:patch_3:*:*:enterprise:windows:*:* | august_2022 patch_3 | Vulnerable | Qlik |
| cpe:2.3:a:qlik:qlik_sense:august_2022:patch_4:*:*:enterprise:windows:*:* | august_2022 patch_4 | Vulnerable | Qlik |
| cpe:2.3:a:qlik:qlik_sense:august_2022:patch_5:*:*:enterprise:windows:*:* | august_2022 patch_5 | Vulnerable | Qlik |
| cpe:2.3:a:qlik:qlik_sense:august_2022:patch_6:*:*:enterprise:windows:*:* | august_2022 patch_6 | Vulnerable | Qlik |
- cpe:2.3:a:qlik:qlik_sense:august_2022:-:*:*:enterprise:windows:*:* Versions august_2022 Vulnerable ·Qlik
- cpe:2.3:a:qlik:qlik_sense:august_2022:patch_1:*:*:enterprise:windows:*:* Versions august_2022 patch_1 Vulnerable ·Qlik
- cpe:2.3:a:qlik:qlik_sense:august_2022:patch_10:*:*:enterprise:windows:*:* Versions august_2022 patch_10 Vulnerable ·Qlik
- cpe:2.3:a:qlik:qlik_sense:august_2022:patch_11:*:*:enterprise:windows:*:* Versions august_2022 patch_11 Vulnerable ·Qlik
- cpe:2.3:a:qlik:qlik_sense:august_2022:patch_12:*:*:enterprise:windows:*:* Versions august_2022 patch_12 Vulnerable ·Qlik
- cpe:2.3:a:qlik:qlik_sense:august_2022:patch_2:*:*:enterprise:windows:*:* Versions august_2022 patch_2 Vulnerable ·Qlik
- cpe:2.3:a:qlik:qlik_sense:august_2022:patch_3:*:*:enterprise:windows:*:* Versions august_2022 patch_3 Vulnerable ·Qlik
- cpe:2.3:a:qlik:qlik_sense:august_2022:patch_4:*:*:enterprise:windows:*:* Versions august_2022 patch_4 Vulnerable ·Qlik
- cpe:2.3:a:qlik:qlik_sense:august_2022:patch_5:*:*:enterprise:windows:*:* Versions august_2022 patch_5 Vulnerable ·Qlik
- cpe:2.3:a:qlik:qlik_sense:august_2022:patch_6:*:*:enterprise:windows:*:* Versions august_2022 patch_6 Vulnerable ·Qlik
Show 26 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:qlik:qlik_sense:august_2022:patch_7:*:*:enterprise:windows:*:* | august_2022 patch_7 | Vulnerable | Qlik |
| cpe:2.3:a:qlik:qlik_sense:august_2022:patch_8:*:*:enterprise:windows:*:* | august_2022 patch_8 | Vulnerable | Qlik |
| cpe:2.3:a:qlik:qlik_sense:august_2022:patch_9:*:*:enterprise:windows:*:* | august_2022 patch_9 | Vulnerable | Qlik |
| cpe:2.3:a:qlik:qlik_sense:february_2023:-:*:*:enterprise:windows:*:* | february_2023 | Vulnerable | Qlik |
| cpe:2.3:a:qlik:qlik_sense:february_2023:patch_1:*:*:enterprise:windows:*:* | february_2023 patch_1 | Vulnerable | Qlik |
| cpe:2.3:a:qlik:qlik_sense:february_2023:patch_2:*:*:enterprise:windows:*:* | february_2023 patch_2 | Vulnerable | Qlik |
| cpe:2.3:a:qlik:qlik_sense:february_2023:patch_3:*:*:enterprise:windows:*:* | february_2023 patch_3 | Vulnerable | Qlik |
| cpe:2.3:a:qlik:qlik_sense:february_2023:patch_4:*:*:enterprise:windows:*:* | february_2023 patch_4 | Vulnerable | Qlik |
| cpe:2.3:a:qlik:qlik_sense:february_2023:patch_5:*:*:enterprise:windows:*:* | february_2023 patch_5 | Vulnerable | Qlik |
| cpe:2.3:a:qlik:qlik_sense:february_2023:patch_6:*:*:enterprise:windows:*:* | february_2023 patch_6 | Vulnerable | Qlik |
| cpe:2.3:a:qlik:qlik_sense:february_2023:patch_7:*:*:enterprise:windows:*:* | february_2023 patch_7 | Vulnerable | Qlik |
| cpe:2.3:a:qlik:qlik_sense:may_2023:-:*:*:enterprise:windows:*:* | may_2023 | Vulnerable | Qlik |
| cpe:2.3:a:qlik:qlik_sense:may_2023:patch_1:*:*:enterprise:windows:*:* | may_2023 patch_1 | Vulnerable | Qlik |
| cpe:2.3:a:qlik:qlik_sense:may_2023:patch_2:*:*:enterprise:windows:*:* | may_2023 patch_2 | Vulnerable | Qlik |
| cpe:2.3:a:qlik:qlik_sense:may_2023:patch3:*:*:enterprise:windows:*:* | may_2023 patch3 | Vulnerable | Qlik |
| cpe:2.3:a:qlik:qlik_sense:november_2022:-:*:*:enterprise:windows:*:* | november_2022 | Vulnerable | Qlik |
| cpe:2.3:a:qlik:qlik_sense:november_2022:patch_1:*:*:enterprise:windows:*:* | november_2022 patch_1 | Vulnerable | Qlik |
| cpe:2.3:a:qlik:qlik_sense:november_2022:patch_10:*:*:enterprise:windows:*:* | november_2022 patch_10 | Vulnerable | Qlik |
| cpe:2.3:a:qlik:qlik_sense:november_2022:patch_2:*:*:enterprise:windows:*:* | november_2022 patch_2 | Vulnerable | Qlik |
| cpe:2.3:a:qlik:qlik_sense:november_2022:patch_3:*:*:enterprise:windows:*:* | november_2022 patch_3 | Vulnerable | Qlik |
| cpe:2.3:a:qlik:qlik_sense:november_2022:patch_4:*:*:enterprise:windows:*:* | november_2022 patch_4 | Vulnerable | Qlik |
| cpe:2.3:a:qlik:qlik_sense:november_2022:patch_5:*:*:enterprise:windows:*:* | november_2022 patch_5 | Vulnerable | Qlik |
| cpe:2.3:a:qlik:qlik_sense:november_2022:patch_6:*:*:enterprise:windows:*:* | november_2022 patch_6 | Vulnerable | Qlik |
| cpe:2.3:a:qlik:qlik_sense:november_2022:patch_7:*:*:enterprise:windows:*:* | november_2022 patch_7 | Vulnerable | Qlik |
| cpe:2.3:a:qlik:qlik_sense:november_2022:patch_8:*:*:enterprise:windows:*:* | november_2022 patch_8 | Vulnerable | Qlik |
| cpe:2.3:a:qlik:qlik_sense:november_2022:patch_9:*:*:enterprise:windows:*:* | november_2022 patch_9 | Vulnerable | Qlik |
- cpe:2.3:a:qlik:qlik_sense:august_2022:patch_7:*:*:enterprise:windows:*:* Versions august_2022 patch_7 Vulnerable ·Qlik
- cpe:2.3:a:qlik:qlik_sense:august_2022:patch_8:*:*:enterprise:windows:*:* Versions august_2022 patch_8 Vulnerable ·Qlik
- cpe:2.3:a:qlik:qlik_sense:august_2022:patch_9:*:*:enterprise:windows:*:* Versions august_2022 patch_9 Vulnerable ·Qlik
- cpe:2.3:a:qlik:qlik_sense:february_2023:-:*:*:enterprise:windows:*:* Versions february_2023 Vulnerable ·Qlik
- cpe:2.3:a:qlik:qlik_sense:february_2023:patch_1:*:*:enterprise:windows:*:* Versions february_2023 patch_1 Vulnerable ·Qlik
- cpe:2.3:a:qlik:qlik_sense:february_2023:patch_2:*:*:enterprise:windows:*:* Versions february_2023 patch_2 Vulnerable ·Qlik
- cpe:2.3:a:qlik:qlik_sense:february_2023:patch_3:*:*:enterprise:windows:*:* Versions february_2023 patch_3 Vulnerable ·Qlik
- cpe:2.3:a:qlik:qlik_sense:february_2023:patch_4:*:*:enterprise:windows:*:* Versions february_2023 patch_4 Vulnerable ·Qlik
- cpe:2.3:a:qlik:qlik_sense:february_2023:patch_5:*:*:enterprise:windows:*:* Versions february_2023 patch_5 Vulnerable ·Qlik
- cpe:2.3:a:qlik:qlik_sense:february_2023:patch_6:*:*:enterprise:windows:*:* Versions february_2023 patch_6 Vulnerable ·Qlik
- cpe:2.3:a:qlik:qlik_sense:february_2023:patch_7:*:*:enterprise:windows:*:* Versions february_2023 patch_7 Vulnerable ·Qlik
- cpe:2.3:a:qlik:qlik_sense:may_2023:-:*:*:enterprise:windows:*:* Versions may_2023 Vulnerable ·Qlik
- cpe:2.3:a:qlik:qlik_sense:may_2023:patch_1:*:*:enterprise:windows:*:* Versions may_2023 patch_1 Vulnerable ·Qlik
- cpe:2.3:a:qlik:qlik_sense:may_2023:patch_2:*:*:enterprise:windows:*:* Versions may_2023 patch_2 Vulnerable ·Qlik
- cpe:2.3:a:qlik:qlik_sense:may_2023:patch3:*:*:enterprise:windows:*:* Versions may_2023 patch3 Vulnerable ·Qlik
- cpe:2.3:a:qlik:qlik_sense:november_2022:-:*:*:enterprise:windows:*:* Versions november_2022 Vulnerable ·Qlik
- cpe:2.3:a:qlik:qlik_sense:november_2022:patch_1:*:*:enterprise:windows:*:* Versions november_2022 patch_1 Vulnerable ·Qlik
- cpe:2.3:a:qlik:qlik_sense:november_2022:patch_10:*:*:enterprise:windows:*:* Versions november_2022 patch_10 Vulnerable ·Qlik
- cpe:2.3:a:qlik:qlik_sense:november_2022:patch_2:*:*:enterprise:windows:*:* Versions november_2022 patch_2 Vulnerable ·Qlik
- cpe:2.3:a:qlik:qlik_sense:november_2022:patch_3:*:*:enterprise:windows:*:* Versions november_2022 patch_3 Vulnerable ·Qlik
- cpe:2.3:a:qlik:qlik_sense:november_2022:patch_4:*:*:enterprise:windows:*:* Versions november_2022 patch_4 Vulnerable ·Qlik
- cpe:2.3:a:qlik:qlik_sense:november_2022:patch_5:*:*:enterprise:windows:*:* Versions november_2022 patch_5 Vulnerable ·Qlik
- cpe:2.3:a:qlik:qlik_sense:november_2022:patch_6:*:*:enterprise:windows:*:* Versions november_2022 patch_6 Vulnerable ·Qlik
- cpe:2.3:a:qlik:qlik_sense:november_2022:patch_7:*:*:enterprise:windows:*:* Versions november_2022 patch_7 Vulnerable ·Qlik
- cpe:2.3:a:qlik:qlik_sense:november_2022:patch_8:*:*:enterprise:windows:*:* Versions november_2022 patch_8 Vulnerable ·Qlik
- cpe:2.3:a:qlik:qlik_sense:november_2022:patch_9:*:*:enterprise:windows:*:* Versions november_2022 patch_9 Vulnerable ·Qlik
Remediation
No fixed version listed by the sources yet.
Timeline
- 2023-12-07 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2023-41266
- 2026-10-03 Alias added: GHSA-fxf5-c62c-5f69
References
More Qlik Sense vulnerabilities
- TI-2023-26226 Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated… KEVCVSS 3.1CRITICAL 9.9
- TI-2023-21870 An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for… KEVCVSS 3.1CRITICAL 9.9
- TI-2025-37930 Qlik Sense Enterprise v14.212.13 was discovered to contain an information leak via the /dev-hub/ directory. CVSS 3.1HIGH 7.5
- TI-2019-08701 An issue was discovered in QlikView Server before 11.20 SR19, 12.00 and 12.10 before… CVSS 3.0HIGH 8.2
- TI-2022-00483 Qlik Sense Enterprise Domain User enumeration CVSS 3.1MEDIUM 5.3
- TI-2021-14883 The GeoAnalytics feature in Qlik Sense April 2020 patch 4 allows SSRF. CVSS 3.1MEDIUM 5.3
Sources
- CVE-2023-41266 · CVE Program
- CVE-2023-41266 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-fxf5-c62c-5f69 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences