CVE-2023-41266 kev+ ransomware in the critical feed json
A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7…
published 2023-08-29 3 y ago modified 2026-08-05 3 mo ago also EUVD-2023-45783
- cvss
- 8.2
- version 3.1, CNA
- cisa kev
- Exploited
- added 2023-12-07, used in ransomware
- epss
- 84.8%
- EPSS 84.8% chance of exploitation in 30 days, percentile 99.7%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows an unauthenticated remote attacker to generate an anonymous session. This allows them to transmit HTTP requests to unauthorized endpoints. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.
Patch / fix
cisa required action Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Timeline
- Published
- CISA SSVC: exploitation active
- Added to CISA KEV
- CISA patch deadline
Known exploited
- Added
- 2 y ago
- Patch by
- 2023-12-28 (2 y ago)
- Ransomware
- Known to be used in ransomware campaigns
- Required action
- Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
- Vendor, product
- Qlik, Sense
- CISA name
- Qlik Sense Path Traversal Vulnerability
CISA SSVC
- Exploitation
- Active, exploited in the wild
- Automatable
- yes
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
84.84% chance of exploitation in the next 30 days, higher than 99.7% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template Qlik Sense Enterprise - Path Traversal nuclei detection template
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.2 | CVSS:3.1/AC:L/AV:N/A:N/C:H/I:L/PR:N/S:U/UI:N |
| CNA | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
Affected products
- qlik qlik_sense
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
community.qlik.com
/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801
vendor-advisory
-
community.qlik.com
/t5/Release-Notes/tkb-p/ReleaseNotes
release-notes
-
cisa.gov
/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41266
government-resource, us-government-resource
Sources
- CVE List CVE-2023-41266
- NVD CVE-2023-41266
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.