CISA Known Exploited Vulnerability

This vulnerability is actively exploited in the wild and listed in the CISA Known Exploited Vulnerabilities catalog.

Remediation Deadline: Dec 28, 2023

CVE-2023-41266

High

EPSS 94.3%CISA KEVRansomware

Qlik/Sense

Description

Qlik Sense contains a path traversal vulnerability that allows a remote, unauthenticated attacker to create an anonymous session by sending maliciously crafted HTTP requests. This anonymous session could allow the attacker to send further requests to unauthorized endpoints.

EPSS — Exploit Probability

94.3%

Higher than 99.9% of all CVEs

Required Action

https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801 ; https://nvd.nist.gov/vuln/detail/CVE-2023-41266

Risk Assessment

CRITICAL

In CISA KEV

High EPSS

Ransomware

Details

Severity: High
EPSS: 94.3%
CISA KEV: Yes
Ransomware: Known
Articles: 0

Timeline

Published

Dec 7, 2023

Added to KEV

Dec 7, 2023

Remediation Due

Dec 28, 2023

Affected Product

Qlik

Sense

View all Qlik CVEs

External Links

NVD (NIST)CVE Details MITRE CVE