CVE-2023-41266: qlik sense

csirt@kutim:~/threat-intel/cve/CVE-2023-41266

CVSS 6.5 · Medium KEV · sudah dieksploitasi Dipakai ransomware EPSS 84,8%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada qlik sense. Skor CVSS 3.1 6.5 (Medium) menurut NVD. Masuk katalog KEV CISA pada 7 Desember 2023, artinya sudah terbukti dieksploitasi. Tercatat dipakai dalam kampanye ransomware.

Deskripsi (NVD)

A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows an unauthenticated remote attacker to generate an anonymous session. This allows them to transmit HTTP requests to unauthorized endpoints. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.

Rincian

Terbit di NVD: 29 Agustus 2023
Terakhir diubah: 5 Agustus 2026
Status NVD: Analyzed
CVSS 3.1: 6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
EPSS (30 hari): 84,8% peluang dieksploitasi; lebih tinggi dari 99,7% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: Qlik Sense Path Traversal Vulnerability
Masuk KEV: 7 Desember 2023
Tenggat CISA: 28 Desember 2023 (untuk instansi federal AS)
Ransomware: Tercatat dipakai dalam kampanye ransomware
Tindakan wajib: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
qlik	qlik sense	Versi august_2022
qlik	qlik sense	Versi august_2022 patch_1
qlik	qlik sense	Versi august_2022 patch_10
qlik	qlik sense	Versi august_2022 patch_11
qlik	qlik sense	Versi august_2022 patch_12
qlik	qlik sense	Versi august_2022 patch_2
qlik	qlik sense	Versi august_2022 patch_3
qlik	qlik sense	Versi august_2022 patch_4
qlik	qlik sense	Versi august_2022 patch_5
qlik	qlik sense	Versi august_2022 patch_6
qlik	qlik sense	Versi august_2022 patch_7
qlik	qlik sense	Versi august_2022 patch_8
qlik	qlik sense	Versi august_2022 patch_9
qlik	qlik sense	Versi february_2023
qlik	qlik sense	Versi february_2023 patch_1
qlik	qlik sense	Versi february_2023 patch_2
qlik	qlik sense	Versi february_2023 patch_3
qlik	qlik sense	Versi february_2023 patch_4
qlik	qlik sense	Versi february_2023 patch_5
qlik	qlik sense	Versi february_2023 patch_6
qlik	qlik sense	Versi february_2023 patch_7
qlik	qlik sense	Versi may_2023
qlik	qlik sense	Versi may_2023 patch_1
qlik	qlik sense	Versi may_2023 patch_2
qlik	qlik sense	Versi may_2023 patch3
qlik	qlik sense	Versi november_2022
qlik	qlik sense	Versi november_2022 patch_1
qlik	qlik sense	Versi november_2022 patch_10
qlik	qlik sense	Versi november_2022 patch_2
qlik	qlik sense	Versi november_2022 patch_3
qlik	qlik sense	Versi november_2022 patch_4
qlik	qlik sense	Versi november_2022 patch_5
qlik	qlik sense	Versi november_2022 patch_6
qlik	qlik sense	Versi november_2022 patch_7
qlik	qlik sense	Versi november_2022 patch_8
qlik	qlik sense	Versi november_2022 patch_9

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-... advisory vendor
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41266 pemerintah AS
https://community.qlik.com/t5/Release-Notes/tkb-p/ReleaseNotes release notes

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.