What is CVE-2023-41265?

CVE-2023-41265 is a critical vulnerability affecting Qlik Sense Enterprise for Windows, with a severity rating of 9.9. This HTTP Request Tunneling vulnerability impacts Windows systems running specific versions of the software, allowing a remote attacker to elevate their privilege and execute requests on the backend server hosting the repository application. It is essential for organizations using the affected software to apply the necessary security fixes to protect their systems from potential exploitation.

Who is impacted by this?

The CVE-2023-41265 vulnerability affects users of Qlik Sense Enterprise for Windows, specifically those running versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier. This issue allows a remote attacker to exploit the system and gain elevated privileges, potentially compromising the server running the Qlik Sense software.

What to do if CVE-2023-41265 affected you

If you're affected by the CVE-2023-41265 vulnerability, it's crucial to update your Qlik Sense Enterprise for Windows to a version containing the necessary security fixes. Here are the steps to follow:

1. Identify if your software version is affected (May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, or August 2022 Patch 12 and earlier).

2. Upgrade to a fixed version: August 2023 Initial Release, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, or August 2022 Patch 13.

3. Download the updated software from the official Qlik Download page (customer login required).

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-41265, also known as Qlik Sense HTTP Tunneling Vulnerability, is indeed listed in CISA's Known Exploited Vulnerabilities Catalog. It was added on December 7, 2023, and the due date for remediation is December 28, 2023.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-444, which involves inconsistent interpretation of HTTP requests, potentially leading to privilege elevation.

Learn More

For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page or the sources listed below.

• Critical Security fixes for Qlik Sense Enterprise for Windows (CVE-2023-41266, CVE-2023-41265)

• BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA

• Known Exploited Vulnerabilities Catalog