CVE-2023-41265

CVE Enrichment

CVSS: 9.9 CRITICAL
EPSS: 88.22%
EPSS Percentile: 99.77%
CISA KEV: YES — Known Exploited Vulnerability

Description

An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows a remote attacker to elevate their privilege by tunneling HTTP requests in the raw HTTP request. This allows them to send requests that get executed by the backend server hosting the repository application. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 30-Aug-2023 06:15
Last Modified: 05-Aug-2026 12:16
EPSS Date: 2026-11-10
CWE: CWE-444

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:L /
                            UI:N /
                            S:C /
                            C:H /
                            I:H /
                            A:H

CISA KEV Details

Date Added: 2023-12-07
Remediation Due: 2023-12-28
Known Ransomware Campaign Use: Known
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Notes: https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801; https://nvd.nist.gov/vuln/detail/CVE-2023-41265

CNA Products / Version Status

qlik · qlik_sense Source: CNA · 134c704f-9b21-4f2e-91b3-4a467353bcc0
Default status: unknown

0 ≤ version ≤ august_2022 — affected (custom)

CPEs: cpe:2.3:a:qlik:qlik_sense:august_2022:patch_12:*:*:enterprise:windows:*:*
qlik · qlik_sense Source: CNA · 134c704f-9b21-4f2e-91b3-4a467353bcc0
Default status: unknown

0 ≤ version ≤ february_2023 — affected (custom)

CPEs: cpe:2.3:a:qlik:qlik_sense:february_2023:patch_7:*:*:enterprise:windows:*:*
qlik · qlik_sense Source: CNA · 134c704f-9b21-4f2e-91b3-4a467353bcc0
Default status: unknown

0 ≤ version ≤ may_2023 — affected (custom)

CPEs: cpe:2.3:a:qlik:qlik_sense:may_2023:-:*:*:enterprise:windows:*:*
n/a · n/a Source: CNA · [email protected]
Default status: unknown

n/a — affected

Affected Products / Versions

qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: august_2022
cpe:2.3:a:qlik:qlik_sense:august_2022:-:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: august_2022
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_1:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: august_2022
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_10:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: august_2022
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_11:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: august_2022
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_12:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: august_2022
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_2:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: august_2022
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_3:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: august_2022
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_4:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: august_2022
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_5:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: august_2022
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_6:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: august_2022
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_7:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: august_2022
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_8:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: august_2022
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_9:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: february_2023
cpe:2.3:a:qlik:qlik_sense:february_2023:-:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: february_2023
cpe:2.3:a:qlik:qlik_sense:february_2023:patch_1:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: february_2023
cpe:2.3:a:qlik:qlik_sense:february_2023:patch_2:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: february_2023
cpe:2.3:a:qlik:qlik_sense:february_2023:patch_3:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: february_2023
cpe:2.3:a:qlik:qlik_sense:february_2023:patch_4:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: february_2023
cpe:2.3:a:qlik:qlik_sense:february_2023:patch_5:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: february_2023
cpe:2.3:a:qlik:qlik_sense:february_2023:patch_6:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: february_2023
cpe:2.3:a:qlik:qlik_sense:february_2023:patch_7:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: may_2023
cpe:2.3:a:qlik:qlik_sense:may_2023:-:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: may_2023
cpe:2.3:a:qlik:qlik_sense:may_2023:patch_1:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: may_2023
cpe:2.3:a:qlik:qlik_sense:may_2023:patch_2:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: may_2023
cpe:2.3:a:qlik:qlik_sense:may_2023:patch3:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: november_2022
cpe:2.3:a:qlik:qlik_sense:november_2022:-:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: november_2022
cpe:2.3:a:qlik:qlik_sense:november_2022:patch_1:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: november_2022
cpe:2.3:a:qlik:qlik_sense:november_2022:patch_10:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: november_2022
cpe:2.3:a:qlik:qlik_sense:november_2022:patch_2:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: november_2022
cpe:2.3:a:qlik:qlik_sense:november_2022:patch_3:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: november_2022
cpe:2.3:a:qlik:qlik_sense:november_2022:patch_4:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: november_2022
cpe:2.3:a:qlik:qlik_sense:november_2022:patch_5:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: november_2022
cpe:2.3:a:qlik:qlik_sense:november_2022:patch_6:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: november_2022
cpe:2.3:a:qlik:qlik_sense:november_2022:patch_7:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: november_2022
cpe:2.3:a:qlik:qlik_sense:november_2022:patch_8:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: november_2022
cpe:2.3:a:qlik:qlik_sense:november_2022:patch_9:*:*:enterprise:windows:*:*

References

Last enrichment sync: 11-Nov-2026 22:34
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

It's worth noting that CVE-2023-48365 (aka DoubleQlik) is an incomplete fix for CVE-2023-41265. Cynet Details Qlik Sense Targeting With Reverse Shells and Staged Exploits

CVE (3)

Threat Actors (1)

MITRE ATT&CK (8)

Vendors (2)

Products (5)

Tools (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.