CVE-2023-41266

CISA KEV RANSOMWARE

ACT NOW Priority: 0.00 BB Relevance: 10/100

Published: N/A Modified: N/A First seen: 2026-10-29 Status: pending_score

Description

Qlik Sense contains a path traversal vulnerability that allows a remote, unauthenticated attacker to create an anonymous session by sending maliciously crafted HTTP requests. This anonymous session could allow the attacker to send further requests to unauthorized endpoints.

CISA Known Exploited Vulnerability

Vendor / Product Qlik — Sense

Date Added 2023-12-07

Remediation Due 2023-12-28

Ransomware Use CONFIRMED

https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801 ; https://nvd.nist.gov/vuln/detail/CVE-2023-41266

Weakness Classification (1)

CWE-22

Affected Software (36)

Vendor	Product	Version
qlik	qlik_sense	august_2022
qlik	qlik_sense	august_2022
qlik	qlik_sense	august_2022
qlik	qlik_sense	august_2022
qlik	qlik_sense	august_2022
qlik	qlik_sense	august_2022
qlik	qlik_sense	august_2022
qlik	qlik_sense	august_2022
qlik	qlik_sense	august_2022
qlik	qlik_sense	august_2022
qlik	qlik_sense	august_2022
qlik	qlik_sense	august_2022
qlik	qlik_sense	august_2022
qlik	qlik_sense	february_2023
qlik	qlik_sense	february_2023
qlik	qlik_sense	february_2023
qlik	qlik_sense	february_2023
qlik	qlik_sense	february_2023
qlik	qlik_sense	february_2023
qlik	qlik_sense	february_2023
qlik	qlik_sense	february_2023
qlik	qlik_sense	may_2023
qlik	qlik_sense	may_2023
qlik	qlik_sense	may_2023
qlik	qlik_sense	may_2023
qlik	qlik_sense	november_2022
qlik	qlik_sense	november_2022
qlik	qlik_sense	november_2022
qlik	qlik_sense	november_2022
qlik	qlik_sense	november_2022