CVE-2023-41265: qlik sense

csirt@kutim:~/threat-intel/cve/CVE-2023-41265

CVSS 9.9 · Critical KEV · sudah dieksploitasi Dipakai ransomware EPSS 88,2%

Kerentanan Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') pada qlik sense. Skor CVSS 3.1 9.9 (Critical) menurut NVD. Masuk katalog KEV CISA pada 7 Desember 2023, artinya sudah terbukti dieksploitasi. Tercatat dipakai dalam kampanye ransomware.

Deskripsi (NVD)

An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows a remote attacker to elevate their privilege by tunneling HTTP requests in the raw HTTP request. This allows them to send requests that get executed by the backend server hosting the repository application. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.

Rincian

Terbit di NVD: 29 Agustus 2023
Terakhir diubah: 5 Agustus 2026
Status NVD: Analyzed
CVSS 3.1: 9.9 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
EPSS (30 hari): 88,2% peluang dieksploitasi; lebih tinggi dari 99,7% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: Qlik Sense HTTP Tunneling Vulnerability
Masuk KEV: 7 Desember 2023
Tenggat CISA: 28 Desember 2023 (untuk instansi federal AS)
Ransomware: Tercatat dipakai dalam kampanye ransomware
Tindakan wajib: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
qlik	qlik sense	Versi august_2022
qlik	qlik sense	Versi august_2022 patch_1
qlik	qlik sense	Versi august_2022 patch_10
qlik	qlik sense	Versi august_2022 patch_11
qlik	qlik sense	Versi august_2022 patch_12
qlik	qlik sense	Versi august_2022 patch_2
qlik	qlik sense	Versi august_2022 patch_3
qlik	qlik sense	Versi august_2022 patch_4
qlik	qlik sense	Versi august_2022 patch_5
qlik	qlik sense	Versi august_2022 patch_6
qlik	qlik sense	Versi august_2022 patch_7
qlik	qlik sense	Versi august_2022 patch_8
qlik	qlik sense	Versi august_2022 patch_9
qlik	qlik sense	Versi february_2023
qlik	qlik sense	Versi february_2023 patch_1
qlik	qlik sense	Versi february_2023 patch_2
qlik	qlik sense	Versi february_2023 patch_3
qlik	qlik sense	Versi february_2023 patch_4
qlik	qlik sense	Versi february_2023 patch_5
qlik	qlik sense	Versi february_2023 patch_6
qlik	qlik sense	Versi february_2023 patch_7
qlik	qlik sense	Versi may_2023
qlik	qlik sense	Versi may_2023 patch_1
qlik	qlik sense	Versi may_2023 patch_2
qlik	qlik sense	Versi may_2023 patch3
qlik	qlik sense	Versi november_2022
qlik	qlik sense	Versi november_2022 patch_1
qlik	qlik sense	Versi november_2022 patch_10
qlik	qlik sense	Versi november_2022 patch_2
qlik	qlik sense	Versi november_2022 patch_3
qlik	qlik sense	Versi november_2022 patch_4
qlik	qlik sense	Versi november_2022 patch_5
qlik	qlik sense	Versi november_2022 patch_6
qlik	qlik sense	Versi november_2022 patch_7
qlik	qlik sense	Versi november_2022 patch_8
qlik	qlik sense	Versi november_2022 patch_9

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-... advisory vendor
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41265 pemerintah AS
https://community.qlik.com/t5/Release-Notes/tkb-p/ReleaseNotes release notes

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.