Skip to content
Fencer Vulns
critical 9.6

CVE-2023-41265 kev+ ransomware in the critical feed json

An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023…

published 2023-08-29 3 y ago modified 2026-08-05 3 mo ago also EUVD-2023-45782

cvss
9.6
version 3.1, CNA
cisa kev
Exploited
added 2023-12-07, used in ransomware
epss
88.2%
EPSS 88.2% chance of exploitation in 30 days, percentile 99.7%
public exploits
0
none known, plus a Nuclei check

Summary

An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows a remote attacker to elevate their privilege by tunneling HTTP requests in the raw HTTP request. This allows them to send requests that get executed by the backend server hosting the repository application. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.

Patch / fix

cisa required action Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

Timeline

  1. Published
  2. CISA SSVC: exploitation active
  3. Added to CISA KEV
  4. CISA patch deadline

Known exploited

Added
2 y ago
Patch by
2023-12-28 (2 y ago)
Ransomware
Known to be used in ransomware campaigns
Required action
Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Vendor, product
Qlik, Sense
CISA name
Qlik Sense HTTP Tunneling Vulnerability

Ransomware

Groups reported to have exploited it in intrusions.

  • Cactus ransomware gang

reported by northwave-cybersecurity.com

Ransomware Vulnerability Matrix by BushidoUK (github.com/BushidoUK/Ransomware-Vulnerability-Matrix), reformatted per CVE. CC BY 4.0

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
yes
Technical impact
total
Assessed
2 y ago

Exploit prediction

88.22% chance of exploitation in the next 30 days, higher than 99.7% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Nuclei template Qlik Sense Enterprise - HTTP Request Smuggling nuclei detection template

CVSS scores

assigned by version score vector
CNA 3.1 9.6 CVSS:3.1/AC:L/AV:N/A:N/C:H/I:H/PR:L/S:C/UI:N
CNA 3.1 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
NVD 3.1 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected products

  • qlik qlik_sense

Classification

Weakness
  • CWE-444 Inconsistent Interpretation of HTTP Requests

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.