CVE-2023-48365

CVE Enrichment

CVSS: 9.9 CRITICAL
EPSS: 47.73%
EPSS Percentile: 98.86%
CISA KEV: YES — Known Exploited Vulnerability

Description

Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attacker is able to elevate their privilege by tunneling HTTP requests, allowing them to execute HTTP requests on the backend server that hosts the repository application. The fixed versions are August 2023 Patch 2, May 2023 Patch 6, February 2023 Patch 10, November 2022 Patch 12, August 2022 Patch 14, May 2022 Patch 16, February 2022 Patch 15, and November 2021 Patch 17. NOTE: this issue exists because of an incomplete fix for CVE-2023-41265.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 16-Nov-2023 05:15
Last Modified: 17-Jun-2026 13:34
EPSS Date: 2026-11-10
CWE: CWE-444

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:L /
                            UI:N /
                            S:C /
                            C:H /
                            I:H /
                            A:H

CISA KEV Details

Date Added: 2025-01-13
Remediation Due: 2025-02-03
Known Ransomware Campaign Use: Known
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes: https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/tac-p/2120510 ; https://nvd.nist.gov/vuln/detail/CVE-2023-48365

CNA Products / Version Status

n/a · n/a Source: CNA · [email protected]
Default status: unknown

n/a — affected

Affected Products / Versions

qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: august_2022
cpe:2.3:a:qlik:qlik_sense:august_2022:-:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: august_2022
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_1:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: august_2022
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_10:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: august_2022
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_11:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: august_2022
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_12:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: august_2022
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_13:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: august_2022
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_2:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: august_2022
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_3:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: august_2022
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_4:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: august_2022
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_5:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: august_2022
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_6:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: august_2022
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_7:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: august_2022
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_8:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: august_2022
cpe:2.3:a:qlik:qlik_sense:august_2022:patch_9:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: august_2023
cpe:2.3:a:qlik:qlik_sense:august_2023:-:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: august_2023
cpe:2.3:a:qlik:qlik_sense:august_2023:patch_1:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: february_2022
cpe:2.3:a:qlik:qlik_sense:february_2022:-:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: february_2022
cpe:2.3:a:qlik:qlik_sense:february_2022:patch_1:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: february_2022
cpe:2.3:a:qlik:qlik_sense:february_2022:patch_10:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: february_2022
cpe:2.3:a:qlik:qlik_sense:february_2022:patch_11:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: february_2022
cpe:2.3:a:qlik:qlik_sense:february_2022:patch_12:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: february_2022
cpe:2.3:a:qlik:qlik_sense:february_2022:patch_13:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: february_2022
cpe:2.3:a:qlik:qlik_sense:february_2022:patch_14:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: february_2022
cpe:2.3:a:qlik:qlik_sense:february_2022:patch_2:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: february_2022
cpe:2.3:a:qlik:qlik_sense:february_2022:patch_3:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: february_2022
cpe:2.3:a:qlik:qlik_sense:february_2022:patch_4:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: february_2022
cpe:2.3:a:qlik:qlik_sense:february_2022:patch_5:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: february_2022
cpe:2.3:a:qlik:qlik_sense:february_2022:patch_6:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: february_2022
cpe:2.3:a:qlik:qlik_sense:february_2022:patch_7:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: february_2022
cpe:2.3:a:qlik:qlik_sense:february_2022:patch_8:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: february_2022
cpe:2.3:a:qlik:qlik_sense:february_2022:patch_9:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: february_2023
cpe:2.3:a:qlik:qlik_sense:february_2023:-:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: february_2023
cpe:2.3:a:qlik:qlik_sense:february_2023:patch_1:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: february_2023
cpe:2.3:a:qlik:qlik_sense:february_2023:patch_2:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: february_2023
cpe:2.3:a:qlik:qlik_sense:february_2023:patch_3:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: february_2023
cpe:2.3:a:qlik:qlik_sense:february_2023:patch_4:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: february_2023
cpe:2.3:a:qlik:qlik_sense:february_2023:patch_5:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: february_2023
cpe:2.3:a:qlik:qlik_sense:february_2023:patch_6:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: february_2023
cpe:2.3:a:qlik:qlik_sense:february_2023:patch_7:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: february_2023
cpe:2.3:a:qlik:qlik_sense:february_2023:patch_8:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: february_2023
cpe:2.3:a:qlik:qlik_sense:february_2023:patch_9:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: may_2022
cpe:2.3:a:qlik:qlik_sense:may_2022:-:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: may_2022
cpe:2.3:a:qlik:qlik_sense:may_2022:patch_1:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: may_2022
cpe:2.3:a:qlik:qlik_sense:may_2022:patch_10:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: may_2022
cpe:2.3:a:qlik:qlik_sense:may_2022:patch_11:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: may_2022
cpe:2.3:a:qlik:qlik_sense:may_2022:patch_12:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: may_2022
cpe:2.3:a:qlik:qlik_sense:may_2022:patch_13:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: may_2022
cpe:2.3:a:qlik:qlik_sense:may_2022:patch_14:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: may_2022
cpe:2.3:a:qlik:qlik_sense:may_2022:patch_15:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: may_2022
cpe:2.3:a:qlik:qlik_sense:may_2022:patch_2:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: may_2022
cpe:2.3:a:qlik:qlik_sense:may_2022:patch_3:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: may_2022
cpe:2.3:a:qlik:qlik_sense:may_2022:patch_4:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: may_2022
cpe:2.3:a:qlik:qlik_sense:may_2022:patch_5:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: may_2022
cpe:2.3:a:qlik:qlik_sense:may_2022:patch_6:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: may_2022
cpe:2.3:a:qlik:qlik_sense:may_2022:patch_7:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: may_2022
cpe:2.3:a:qlik:qlik_sense:may_2022:patch_8:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: may_2022
cpe:2.3:a:qlik:qlik_sense:may_2022:patch_9:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: may_2023
cpe:2.3:a:qlik:qlik_sense:may_2023:-:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: may_2023
cpe:2.3:a:qlik:qlik_sense:may_2023:patch_1:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: may_2023
cpe:2.3:a:qlik:qlik_sense:may_2023:patch_2:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: may_2023
cpe:2.3:a:qlik:qlik_sense:may_2023:patch_3:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: may_2023
cpe:2.3:a:qlik:qlik_sense:may_2023:patch_4:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: may_2023
cpe:2.3:a:qlik:qlik_sense:may_2023:patch_5:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: november_2021
cpe:2.3:a:qlik:qlik_sense:november_2021:-:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: november_2021
cpe:2.3:a:qlik:qlik_sense:november_2021:patch_1:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: november_2021
cpe:2.3:a:qlik:qlik_sense:november_2021:patch_10:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: november_2021
cpe:2.3:a:qlik:qlik_sense:november_2021:patch_11:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: november_2021
cpe:2.3:a:qlik:qlik_sense:november_2021:patch_12:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: november_2021
cpe:2.3:a:qlik:qlik_sense:november_2021:patch_13:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: november_2021
cpe:2.3:a:qlik:qlik_sense:november_2021:patch_14:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: november_2021
cpe:2.3:a:qlik:qlik_sense:november_2021:patch_15:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: november_2021
cpe:2.3:a:qlik:qlik_sense:november_2021:patch_16:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: november_2021
cpe:2.3:a:qlik:qlik_sense:november_2021:patch_2:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: november_2021
cpe:2.3:a:qlik:qlik_sense:november_2021:patch_3:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: november_2021
cpe:2.3:a:qlik:qlik_sense:november_2021:patch_4:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: november_2021
cpe:2.3:a:qlik:qlik_sense:november_2021:patch_5:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: november_2021
cpe:2.3:a:qlik:qlik_sense:november_2021:patch_6:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: november_2021
cpe:2.3:a:qlik:qlik_sense:november_2021:patch_7:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: november_2021
cpe:2.3:a:qlik:qlik_sense:november_2021:patch_8:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: november_2021
cpe:2.3:a:qlik:qlik_sense:november_2021:patch_9:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: november_2022
cpe:2.3:a:qlik:qlik_sense:november_2022:-:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: november_2022
cpe:2.3:a:qlik:qlik_sense:november_2022:patch_1:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: november_2022
cpe:2.3:a:qlik:qlik_sense:november_2022:patch_10:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: november_2022
cpe:2.3:a:qlik:qlik_sense:november_2022:patch_11:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: november_2022
cpe:2.3:a:qlik:qlik_sense:november_2022:patch_2:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: november_2022
cpe:2.3:a:qlik:qlik_sense:november_2022:patch_3:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: november_2022
cpe:2.3:a:qlik:qlik_sense:november_2022:patch_4:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: november_2022
cpe:2.3:a:qlik:qlik_sense:november_2022:patch_5:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: november_2022
cpe:2.3:a:qlik:qlik_sense:november_2022:patch_6:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: november_2022
cpe:2.3:a:qlik:qlik_sense:november_2022:patch_7:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: november_2022
cpe:2.3:a:qlik:qlik_sense:november_2022:patch_8:*:*:enterprise:windows:*:*
qlik / qlik_sense Source: NVD CPE · affected
Version / affected range: november_2022
cpe:2.3:a:qlik:qlik_sense:november_2022:patch_9:*:*:enterprise:windows:*:*

References

Last enrichment sync: 11-Nov-2026 22:31
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

It's worth noting that CVE-2023-48365 (aka DoubleQlik) is an incomplete fix for CVE-2023-41265. Cynet Details Qlik Sense Targeting With Reverse Shells and Staged Exploits

CVE (3)

Threat Actors (1)

MITRE ATT&CK (8)

Vendors (2)

Products (5)

Tools (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.