QID 730994

Date Published: 2023-12-19

QID 730994: Qlik Sense Enterprise for Windows Multiple Security Vulnerabilities

Qlik Sense is a self-service data visualization and discovery application designed for individuals and group collaboration.

Qlik Sense Enterprise for Windows prior to and including these releases contain the following vulnerabilities:
CVE-2023-48365 (QB-21683) HTTP Tunneling vulnerability in Qlik Sense Enterprise for Windows.
CVE-2023-41266 (QB-21220) Path traversal in Qlik Sense Enterprise for Windows.
CVE-2023-41265 (QB-21222) HTTP Tunneling vulnerability in Qlik Sense Enterprise for Windows

Affected Versions:
August 2023 Patch 1
May 2023 Patch 5
February 2023 Patch 9
November 2022 Patch 11
August 2022 Patch 13
May 2022 Patch 15
February 2022 Patch 14
November 2021 Patch 16

QID Detection Logic:
This QID detects vulnerable versions of the application based on directory traversal requests to /resources/qmc/fonts/../../../qrs/ReloadTask resource.

Depending on the vulnerability being exploited, an unauthenticated, remote attacker could exploit these vulnerabilities to conduct path traverversal or execute arbitrary code on a targeted system.

  • CVSS V3 rated as Critical - 9.9 severity.
  • CVSS V2 rated as High - 6.8 severity.
    • Solution
    Customers are advised to refer to the vendor advisory 2120510 for more information pertaining to these vulnerabilities.

    Vendor References

    CVEs related to QID 730994

    CVE-2023-41266 | CVE-2023-41265 | CVE-2023-48365 |
    Software Advisories
    Advisory ID Software Component Link
    2120510 URL Logo community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/tac-p/2120510
    By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].