Search criteria
21 vulnerabilities found for qlik_sense by qlik
CVE-2025-61138 (GCVE-0-2025-61138)
Vulnerability from nvd – Published: 2025-11-20 00:00 – Updated: 2025-11-21 16:03
VLAI?
Summary
Qlik Sense Enterprise v14.212.13 was discovered to contain an information leak via the /dev-hub/ directory.
Severity ?
7.5 (High)
CWE
- n/a
Assigner
References
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-61138",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-21T15:58:02.383680Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-538",
"description": "CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-21T16:03:38.792Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Qlik Sense Enterprise v14.212.13 was discovered to contain an information leak via the /dev-hub/ directory."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-20T21:20:44.014Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://gist.github.com/Israel0x00/8a81ec98162e9ca8e4a3a6c8b4ef4762"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2025-61138",
"datePublished": "2025-11-20T00:00:00.000Z",
"dateReserved": "2025-09-26T00:00:00.000Z",
"dateUpdated": "2025-11-21T16:03:38.792Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-48365 (GCVE-0-2023-48365)
Vulnerability from nvd – Published: 2023-11-15 00:00 – Updated: 2025-10-21 23:05
VLAI?
Summary
Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attacker is able to elevate their privilege by tunneling HTTP requests, allowing them to execute HTTP requests on the backend server that hosts the repository application. The fixed versions are August 2023 Patch 2, May 2023 Patch 6, February 2023 Patch 10, November 2022 Patch 12, August 2022 Patch 14, May 2022 Patch 16, February 2022 Patch 15, and November 2021 Patch 17. NOTE: this issue exists because of an incomplete fix for CVE-2023-41265.
Severity ?
9.6 (Critical)
CWE
- n/a
Assigner
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T21:30:34.616Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/tac-p/2120510"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-48365",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-13T15:33:34.009005Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2025-01-13",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-48365"
},
"type": "kev"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444 Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-21T23:05:32.191Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-48365"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-01-13T00:00:00+00:00",
"value": "CVE-2023-48365 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attacker is able to elevate their privilege by tunneling HTTP requests, allowing them to execute HTTP requests on the backend server that hosts the repository application. The fixed versions are August 2023 Patch 2, May 2023 Patch 6, February 2023 Patch 10, November 2022 Patch 12, August 2022 Patch 14, May 2022 Patch 16, February 2022 Patch 15, and November 2021 Patch 17. NOTE: this issue exists because of an incomplete fix for CVE-2023-41265."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AC:L/AV:N/A:N/C:H/I:H/PR:L/S:C/UI:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-11-15T21:15:52.732Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/tac-p/2120510"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-48365",
"datePublished": "2023-11-15T00:00:00.000Z",
"dateReserved": "2023-11-15T00:00:00.000Z",
"dateUpdated": "2025-10-21T23:05:32.191Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-41265 (GCVE-0-2023-41265)
Vulnerability from nvd – Published: 2023-08-29 00:00 – Updated: 2025-10-30 16:25
VLAI?
Summary
An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows a remote attacker to elevate their privilege by tunneling HTTP requests in the raw HTTP request. This allows them to send requests that get executed by the backend server hosting the repository application. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.
Severity ?
9.6 (Critical)
CWE
- n/a
Assigner
References
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:qlik:qlik_sense:may_2023:-:*:*:enterprise:windows:*:*"
],
"defaultStatus": "unknown",
"product": "qlik_sense",
"vendor": "qlik",
"versions": [
{
"lessThanOrEqual": "may_2023",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:qlik:qlik_sense:february_2023:patch_7:*:*:enterprise:windows:*:*"
],
"defaultStatus": "unknown",
"product": "qlik_sense",
"vendor": "qlik",
"versions": [
{
"lessThanOrEqual": "february_2023",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:qlik:qlik_sense:august_2022:patch_12:*:*:enterprise:windows:*:*"
],
"defaultStatus": "unknown",
"product": "qlik_sense",
"vendor": "qlik",
"versions": [
{
"lessThanOrEqual": "august_2022",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-41265",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-23T04:01:03.009998Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2023-12-07",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41265"
},
"type": "kev"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444 Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-30T16:25:59.533Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41265"
}
],
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:54:05.059Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://community.qlik.com/t5/Release-Notes/tkb-p/ReleaseNotes"
},
{
"tags": [
"x_transferred"
],
"url": "https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows a remote attacker to elevate their privilege by tunneling HTTP requests in the raw HTTP request. This allows them to send requests that get executed by the backend server hosting the repository application. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AC:L/AV:N/A:N/C:H/I:H/PR:L/S:C/UI:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-08-29T22:34:49.015Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://community.qlik.com/t5/Release-Notes/tkb-p/ReleaseNotes"
},
{
"url": "https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-41265",
"datePublished": "2023-08-29T00:00:00.000Z",
"dateReserved": "2023-08-25T00:00:00.000Z",
"dateUpdated": "2025-10-30T16:25:59.533Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-41266 (GCVE-0-2023-41266)
Vulnerability from nvd – Published: 2023-08-29 00:00 – Updated: 2025-10-30 15:32
VLAI?
Summary
A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows an unauthenticated remote attacker to generate an anonymous session. This allows them to transmit HTTP requests to unauthorized endpoints. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.
Severity ?
8.2 (High)
CWE
- n/a
Assigner
References
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:qlik:qlik_sense:august_2022:patch_12:*:*:enterprise:windows:*:*"
],
"defaultStatus": "unknown",
"product": "qlik_sense",
"vendor": "qlik",
"versions": [
{
"lessThanOrEqual": "august_2022",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:qlik:qlik_sense:may_2023:patch3:*:*:enterprise:windows:*:*"
],
"defaultStatus": "unknown",
"product": "qlik_sense",
"vendor": "qlik",
"versions": [
{
"lessThanOrEqual": "may_2023",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:qlik:qlik_sense:february_2023:patch_7:*:*:enterprise:windows:*:*"
],
"defaultStatus": "unknown",
"product": "qlik_sense",
"vendor": "qlik",
"versions": [
{
"lessThanOrEqual": "february_2023",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:qlik:qlik_sense:november_2022:patch_10:*:*:enterprise:windows:*:*"
],
"defaultStatus": "unknown",
"product": "qlik_sense",
"vendor": "qlik",
"versions": [
{
"lessThanOrEqual": "november_2022",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-41266",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-23T04:01:03.822744Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2023-12-07",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41266"
},
"type": "kev"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-30T15:32:22.573Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41266"
}
],
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:54:04.991Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://community.qlik.com/t5/Release-Notes/tkb-p/ReleaseNotes"
},
{
"tags": [
"x_transferred"
],
"url": "https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows an unauthenticated remote attacker to generate an anonymous session. This allows them to transmit HTTP requests to unauthorized endpoints. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AC:L/AV:N/A:N/C:H/I:L/PR:N/S:U/UI:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-08-29T22:34:56.594Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://community.qlik.com/t5/Release-Notes/tkb-p/ReleaseNotes"
},
{
"url": "https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-41266",
"datePublished": "2023-08-29T00:00:00.000Z",
"dateReserved": "2023-08-25T00:00:00.000Z",
"dateUpdated": "2025-10-30T15:32:22.573Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2021-36761 (GCVE-0-2021-36761)
Vulnerability from nvd – Published: 2022-06-21 16:07 – Updated: 2024-08-04 01:01
VLAI?
Summary
The GeoAnalytics feature in Qlik Sense April 2020 patch 4 allows SSRF.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T01:01:59.307Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.cyberiskvision.com/advisory/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The GeoAnalytics feature in Qlik Sense April 2020 patch 4 allows SSRF."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-21T16:07:30",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.cyberiskvision.com/advisory/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-36761",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The GeoAnalytics feature in Qlik Sense April 2020 patch 4 allows SSRF."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cyberiskvision.com/advisory/",
"refsource": "MISC",
"url": "https://www.cyberiskvision.com/advisory/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-36761",
"datePublished": "2022-06-21T16:07:30",
"dateReserved": "2021-07-16T00:00:00",
"dateUpdated": "2024-08-04T01:01:59.307Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-0564 (GCVE-0-2022-0564)
Vulnerability from nvd – Published: 2022-02-21 00:00 – Updated: 2025-04-25 15:46
VLAI?
Summary
A vulnerability in Qlik Sense Enterprise on Windows could allow an remote attacker to enumerate domain user accounts. An attacker could exploit this vulnerability by sending authentication requests to an affected system. A successful exploit could allow the attacker to compare the response time that are returned by the affected system to determine which accounts are valid user accounts. Affected systems are only vulnerable if they have LDAP configured.
The affected URI is /internal_forms_authentication/ the response time of the form is longer if the supplied user does not exists and shorter if the user exists.
Severity ?
5.3 (Medium)
CWE
- CWE-204 - Observable Response Discrepancy
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Qlik Sense | Qlik Sense Enterprise on Windows |
Affected:
14.x , < 14.44.0
(custom)
|
Credits
Hidde Smit (DIVD)
Diego Klinkhamer (DIVD)
Frank Breedijk (DIVD)
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T23:32:46.219Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"third-party-advisory",
"x_transferred"
],
"url": "https://csirt.divd.nl/DIVD-2021-00021/"
},
{
"tags": [
"third-party-advisory",
"x_transferred"
],
"url": "https://csirt.divd.nl/CVE-2022-0564/"
},
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://community.qlik.com/t5/Release-Notes/Qlik-Sense-Enterprise-on-Windows-November-2021-Initial-Release/ta-p/1856531"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Qlik Sense Enterprise on Windows",
"vendor": "Qlik Sense",
"versions": [
{
"lessThan": "14.44.0",
"status": "affected",
"version": "14.x",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Hidde Smit (DIVD)"
},
{
"lang": "en",
"type": "analyst",
"value": "Diego Klinkhamer (DIVD)"
},
{
"lang": "en",
"type": "analyst",
"value": "Frank Breedijk (DIVD)"
}
],
"datePublic": "2022-02-20T23:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability in Qlik Sense Enterprise on Windows could allow an remote attacker to enumerate domain user accounts. An attacker could exploit this vulnerability by sending authentication requests to an affected system. A successful exploit could allow the attacker to compare the response time that are returned by the affected system to determine which accounts are valid user accounts. Affected systems are only vulnerable if they have LDAP configured.\u003cbr\u003e\u003cbr\u003eThe affected URI is /internal_forms_authentication/ the response time of the form is longer if the supplied user does not exists and shorter if the user exists."
}
],
"value": "A vulnerability in Qlik Sense Enterprise on Windows could allow an remote attacker to enumerate domain user accounts. An attacker could exploit this vulnerability by sending authentication requests to an affected system. A successful exploit could allow the attacker to compare the response time that are returned by the affected system to determine which accounts are valid user accounts. Affected systems are only vulnerable if they have LDAP configured.\n\nThe affected URI is /internal_forms_authentication/ the response time of the form is longer if the supplied user does not exists and shorter if the user exists."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-204",
"description": "CWE-204: Observable Response Discrepancy",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-25T15:46:06.267Z",
"orgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
"shortName": "DIVD"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://csirt.divd.nl/DIVD-2021-00021/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://csirt.divd.nl/CVE-2022-0564/"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://community.qlik.com/t5/Release-Notes/Qlik-Sense-Enterprise-on-Windows-November-2021-Initial-Release/ta-p/1856531"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpdate Qlik Sense Enterprise on Windows to version 14.44.0 or higher.\u003c/p\u003e"
}
],
"value": "Update Qlik Sense Enterprise on Windows to version 14.44.0 or higher."
}
],
"source": {
"advisory": "DIVD-2021-00021",
"discovery": "INTERNAL"
},
"title": "Qlik Sense Enterprise Domain User enumeration",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eDisable internet-facing NTLM endpoints, e.g. internal_windows_authentication, to avoid domain enumeration.\u003c/p\u003e"
}
],
"value": "Disable internet-facing NTLM endpoints, e.g. internal_windows_authentication, to avoid domain enumeration."
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
}
}
},
"cveMetadata": {
"assignerOrgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
"assignerShortName": "DIVD",
"cveId": "CVE-2022-0564",
"datePublished": "2022-02-21T00:00:00",
"dateReserved": "2022-02-10T00:00:00",
"dateUpdated": "2025-04-25T15:46:06.267Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-11628 (GCVE-0-2019-11628)
Vulnerability from nvd – Published: 2019-05-01 02:07 – Updated: 2024-08-04 22:55
VLAI?
Summary
An issue was discovered in QlikView Server before 11.20 SR19, 12.00 and 12.10 before 12.10 SR11, 12.20 before SR9, and 12.30 before SR2; and Qlik Sense Enterprise and Qlik Analytics Platform installations that lack these patch levels: February 2018 Patch 4, April 2018 Patch 3, June 2018 Patch 3, September 2018 Patch 4, November 2018 Patch 4, or February 2019 Patch 2. An authenticated user may be able to bypass intended file-read restrictions via crafted Browser requests.
Severity ?
8.2 (High)
CWE
- n/a
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T22:55:41.045Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://qliksupport.force.com/articles/000069985"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in QlikView Server before 11.20 SR19, 12.00 and 12.10 before 12.10 SR11, 12.20 before SR9, and 12.30 before SR2; and Qlik Sense Enterprise and Qlik Analytics Platform installations that lack these patch levels: February 2018 Patch 4, April 2018 Patch 3, June 2018 Patch 3, September 2018 Patch 4, November 2018 Patch 4, or February 2019 Patch 2. An authenticated user may be able to bypass intended file-read restrictions via crafted Browser requests."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AC:H/AV:N/A:N/C:H/I:H/PR:L/S:C/UI:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-05-01T02:07:47",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://qliksupport.force.com/articles/000069985"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-11628",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in QlikView Server before 11.20 SR19, 12.00 and 12.10 before 12.10 SR11, 12.20 before SR9, and 12.30 before SR2; and Qlik Sense Enterprise and Qlik Analytics Platform installations that lack these patch levels: February 2018 Patch 4, April 2018 Patch 3, June 2018 Patch 3, September 2018 Patch 4, November 2018 Patch 4, or February 2019 Patch 2. An authenticated user may be able to bypass intended file-read restrictions via crafted Browser requests."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AC:H/AV:N/A:N/C:H/I:H/PR:L/S:C/UI:N",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://qliksupport.force.com/articles/000069985",
"refsource": "MISC",
"url": "https://qliksupport.force.com/articles/000069985"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-11628",
"datePublished": "2019-05-01T02:07:47",
"dateReserved": "2019-04-30T00:00:00",
"dateUpdated": "2024-08-04T22:55:41.045Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
FKIE_CVE-2025-61138
Vulnerability from fkie_nvd - Published: 2025-11-20 22:16 - Updated: 2025-12-10 20:45
Severity ?
Summary
Qlik Sense Enterprise v14.212.13 was discovered to contain an information leak via the /dev-hub/ directory.
References
| URL | Tags | ||
|---|---|---|---|
| cve@mitre.org | https://gist.github.com/Israel0x00/8a81ec98162e9ca8e4a3a6c8b4ef4762 | Mitigation, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| qlik | qlik_sense | 14.212.13 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:14.212.13:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "94801095-619D-41F4-AE29-11E0CC268650",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Qlik Sense Enterprise v14.212.13 was discovered to contain an information leak via the /dev-hub/ directory."
}
],
"id": "CVE-2025-61138",
"lastModified": "2025-12-10T20:45:07.557",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
},
"published": "2025-11-20T22:16:01.610",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Mitigation",
"Third Party Advisory"
],
"url": "https://gist.github.com/Israel0x00/8a81ec98162e9ca8e4a3a6c8b4ef4762"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-538"
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
}
FKIE_CVE-2023-48365
Vulnerability from fkie_nvd - Published: 2023-11-15 22:15 - Updated: 2025-10-31 14:38
Severity ?
9.6 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
9.9 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
9.9 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Summary
Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attacker is able to elevate their privilege by tunneling HTTP requests, allowing them to execute HTTP requests on the backend server that hosts the repository application. The fixed versions are August 2023 Patch 2, May 2023 Patch 6, February 2023 Patch 10, November 2022 Patch 12, August 2022 Patch 14, May 2022 Patch 16, February 2022 Patch 15, and November 2021 Patch 17. NOTE: this issue exists because of an incomplete fix for CVE-2023-41265.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2023 | |
| qlik | qlik_sense | august_2023 | |
| qlik | qlik_sense | february_2022 | |
| qlik | qlik_sense | february_2022 | |
| qlik | qlik_sense | february_2022 | |
| qlik | qlik_sense | february_2022 | |
| qlik | qlik_sense | february_2022 | |
| qlik | qlik_sense | february_2022 | |
| qlik | qlik_sense | february_2022 | |
| qlik | qlik_sense | february_2022 | |
| qlik | qlik_sense | february_2022 | |
| qlik | qlik_sense | february_2022 | |
| qlik | qlik_sense | february_2022 | |
| qlik | qlik_sense | february_2022 | |
| qlik | qlik_sense | february_2022 | |
| qlik | qlik_sense | february_2022 | |
| qlik | qlik_sense | february_2022 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | may_2022 | |
| qlik | qlik_sense | may_2022 | |
| qlik | qlik_sense | may_2022 | |
| qlik | qlik_sense | may_2022 | |
| qlik | qlik_sense | may_2022 | |
| qlik | qlik_sense | may_2022 | |
| qlik | qlik_sense | may_2022 | |
| qlik | qlik_sense | may_2022 | |
| qlik | qlik_sense | may_2022 | |
| qlik | qlik_sense | may_2022 | |
| qlik | qlik_sense | may_2022 | |
| qlik | qlik_sense | may_2022 | |
| qlik | qlik_sense | may_2022 | |
| qlik | qlik_sense | may_2022 | |
| qlik | qlik_sense | may_2022 | |
| qlik | qlik_sense | may_2022 | |
| qlik | qlik_sense | may_2023 | |
| qlik | qlik_sense | may_2023 | |
| qlik | qlik_sense | may_2023 | |
| qlik | qlik_sense | may_2023 | |
| qlik | qlik_sense | may_2023 | |
| qlik | qlik_sense | may_2023 | |
| qlik | qlik_sense | november_2021 | |
| qlik | qlik_sense | november_2021 | |
| qlik | qlik_sense | november_2021 | |
| qlik | qlik_sense | november_2021 | |
| qlik | qlik_sense | november_2021 | |
| qlik | qlik_sense | november_2021 | |
| qlik | qlik_sense | november_2021 | |
| qlik | qlik_sense | november_2021 | |
| qlik | qlik_sense | november_2021 | |
| qlik | qlik_sense | november_2021 | |
| qlik | qlik_sense | november_2021 | |
| qlik | qlik_sense | november_2021 | |
| qlik | qlik_sense | november_2021 | |
| qlik | qlik_sense | november_2021 | |
| qlik | qlik_sense | november_2021 | |
| qlik | qlik_sense | november_2021 | |
| qlik | qlik_sense | november_2021 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 |
{
"cisaActionDue": "2025-02-03",
"cisaExploitAdd": "2025-01-13",
"cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
"cisaVulnerabilityName": "Qlik Sense HTTP Tunneling Vulnerability",
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:-:*:*:enterprise:windows:*:*",
"matchCriteriaId": "41AEA1CA-D344-48DB-92D8-05D0EDC8487D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_1:*:*:enterprise:windows:*:*",
"matchCriteriaId": "FC12BB7A-366F-4EE2-AABF-19E83B5B9EC7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_10:*:*:enterprise:windows:*:*",
"matchCriteriaId": "5F601CFC-70D0-450B-AE49-058E6B887E15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_11:*:*:enterprise:windows:*:*",
"matchCriteriaId": "17E7F947-3322-46BB-9B89-689F1B792D89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_12:*:*:enterprise:windows:*:*",
"matchCriteriaId": "37AF6E89-73F0-49E8-82F4-08084A5EBE2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_13:*:*:enterprise:windows:*:*",
"matchCriteriaId": "B633BE26-057C-403F-A4BB-270E1D709ADF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_2:*:*:enterprise:windows:*:*",
"matchCriteriaId": "E4C7CBBB-C6A0-460E-95DC-C1855826C7F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_3:*:*:enterprise:windows:*:*",
"matchCriteriaId": "BD491E32-270C-452B-AC1E-FB8F509B916E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_4:*:*:enterprise:windows:*:*",
"matchCriteriaId": "EDE2809B-4234-443E-9E6A-6B402D258617",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_5:*:*:enterprise:windows:*:*",
"matchCriteriaId": "155F0D6F-2E4A-40E7-9145-7D130334466B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_6:*:*:enterprise:windows:*:*",
"matchCriteriaId": "D733F495-E0EF-4F25-8532-2773415EFB8B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_7:*:*:enterprise:windows:*:*",
"matchCriteriaId": "578092D7-0F52-45C1-B7E2-FC5AF86AB8ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_8:*:*:enterprise:windows:*:*",
"matchCriteriaId": "1B3164BA-0BDB-41F9-B51C-4FB0489A125A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_9:*:*:enterprise:windows:*:*",
"matchCriteriaId": "E0D31C35-50DC-4CDF-AFD4-311EAF5BBBD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2023:-:*:*:enterprise:windows:*:*",
"matchCriteriaId": "34047E2B-26A8-46F4-A9FA-24E4C997AF58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2023:patch_1:*:*:enterprise:windows:*:*",
"matchCriteriaId": "3310512E-BDAA-46E4-925E-6BEF1E25417F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2022:-:*:*:enterprise:windows:*:*",
"matchCriteriaId": "24422FCB-D58E-4E00-A541-7557CFD9D30A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2022:patch_1:*:*:enterprise:windows:*:*",
"matchCriteriaId": "050A35DF-46A5-4327-8A13-07D1DD3E4F49",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2022:patch_10:*:*:enterprise:windows:*:*",
"matchCriteriaId": "8E1D08FE-49DA-41B2-B562-4CC50BF6C361",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2022:patch_11:*:*:enterprise:windows:*:*",
"matchCriteriaId": "2ED9A41B-9E76-4B6E-BDB5-FEE969DEAFDD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2022:patch_12:*:*:enterprise:windows:*:*",
"matchCriteriaId": "96E3A247-C5AD-4A84-855B-118386424087",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2022:patch_13:*:*:enterprise:windows:*:*",
"matchCriteriaId": "DDA98915-B4BA-4044-8404-2AFAB25EAA06",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2022:patch_14:*:*:enterprise:windows:*:*",
"matchCriteriaId": "F9DA8A45-9FEF-486E-AD6A-C5A9D15D0246",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2022:patch_2:*:*:enterprise:windows:*:*",
"matchCriteriaId": "AFCDA4AC-758E-4999-94B6-D3BA24F03BB1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2022:patch_3:*:*:enterprise:windows:*:*",
"matchCriteriaId": "83547AC9-E4E6-4FF9-94CE-DDB32BF1D41F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2022:patch_4:*:*:enterprise:windows:*:*",
"matchCriteriaId": "35881EDA-560B-4C5C-9388-EC44F4B89F83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2022:patch_5:*:*:enterprise:windows:*:*",
"matchCriteriaId": "C090D35D-6ED8-406A-AC58-6A79280F52A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2022:patch_6:*:*:enterprise:windows:*:*",
"matchCriteriaId": "39DF7548-666A-4903-8785-7CD7295DA6E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2022:patch_7:*:*:enterprise:windows:*:*",
"matchCriteriaId": "F8467611-FF63-4154-AC76-ED7A876A46CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2022:patch_8:*:*:enterprise:windows:*:*",
"matchCriteriaId": "B6D680D9-1049-4CA5-9AFD-1EC5C6B0DC5C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2022:patch_9:*:*:enterprise:windows:*:*",
"matchCriteriaId": "E721B224-0A35-4A9B-BD44-5B127FF1E6E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:-:*:*:enterprise:windows:*:*",
"matchCriteriaId": "95BBBA68-269F-4385-9D14-A736F2CD707E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_1:*:*:enterprise:windows:*:*",
"matchCriteriaId": "E6E1046C-35F4-451A-BFF1-2FC6EB01B547",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_2:*:*:enterprise:windows:*:*",
"matchCriteriaId": "D9AB037B-EE88-47CD-B387-42651CBAAFF9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_3:*:*:enterprise:windows:*:*",
"matchCriteriaId": "3D28B87A-B36A-428E-A93B-255CFD62036F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_4:*:*:enterprise:windows:*:*",
"matchCriteriaId": "9AD961D6-A315-493C-926F-1441E51C1742",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_5:*:*:enterprise:windows:*:*",
"matchCriteriaId": "1EFEBD77-7968-4649-8E9B-DAB24DC36E64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_6:*:*:enterprise:windows:*:*",
"matchCriteriaId": "E6D033E6-C022-4C6B-9EAC-95ABF6CA9BA6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_7:*:*:enterprise:windows:*:*",
"matchCriteriaId": "761B402F-4E98-46A4-A8E3-87F167CF01D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_8:*:*:enterprise:windows:*:*",
"matchCriteriaId": "5523F0D6-0017-4A1B-9A02-8108731DE05C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_9:*:*:enterprise:windows:*:*",
"matchCriteriaId": "5B1B9FCD-3499-4F0B-97FC-C693942FF0EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2022:-:*:*:enterprise:windows:*:*",
"matchCriteriaId": "12C6F742-F9E3-4F02-9610-B187E8DF9B61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2022:patch_1:*:*:enterprise:windows:*:*",
"matchCriteriaId": "9EE55EBA-35E6-4538-BA42-AB0AF18FBC78",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2022:patch_10:*:*:enterprise:windows:*:*",
"matchCriteriaId": "A32668D9-297C-443A-94BA-5EE404B56286",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2022:patch_11:*:*:enterprise:windows:*:*",
"matchCriteriaId": "4345AFA4-785C-4723-B7C5-0B1C74AFEB64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2022:patch_12:*:*:enterprise:windows:*:*",
"matchCriteriaId": "778E7986-3F4E-4AA0-BBBD-FB2C454B8170",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2022:patch_13:*:*:enterprise:windows:*:*",
"matchCriteriaId": "F8822B86-2222-47B4-AE4B-A0E43523DAAB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2022:patch_14:*:*:enterprise:windows:*:*",
"matchCriteriaId": "C8B23C50-2E46-4248-931F-CCFB6E96A115",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2022:patch_15:*:*:enterprise:windows:*:*",
"matchCriteriaId": "9C62E965-1663-419B-9C06-98655D4B0569",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2022:patch_2:*:*:enterprise:windows:*:*",
"matchCriteriaId": "E23565A3-34D2-40AA-8CB9-AB6EB4DDC776",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2022:patch_3:*:*:enterprise:windows:*:*",
"matchCriteriaId": "D2BCA144-1D99-48B4-B803-14049B14632B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2022:patch_4:*:*:enterprise:windows:*:*",
"matchCriteriaId": "64E043EC-C2A5-47C8-85BC-190607E7798C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2022:patch_5:*:*:enterprise:windows:*:*",
"matchCriteriaId": "035B8F10-67E0-4A73-863E-9A8C76C1EF9F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2022:patch_6:*:*:enterprise:windows:*:*",
"matchCriteriaId": "4B40BC46-2A7E-4019-A0B1-6D3981ECB002",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2022:patch_7:*:*:enterprise:windows:*:*",
"matchCriteriaId": "CA7C07E6-AFEB-4A9A-B9E7-D0EFE34B4DCC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2022:patch_8:*:*:enterprise:windows:*:*",
"matchCriteriaId": "C3DF6FC7-FB30-4A5C-A9E6-EB61DA00BB3A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2022:patch_9:*:*:enterprise:windows:*:*",
"matchCriteriaId": "12263319-ECAB-4AEA-B421-134A1816FF0C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2023:-:*:*:enterprise:windows:*:*",
"matchCriteriaId": "9E7034FB-5E64-47AD-B4A4-8428474C48C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2023:patch_1:*:*:enterprise:windows:*:*",
"matchCriteriaId": "29158A06-3DE9-487B-9BC5-B4A690864F4F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2023:patch_2:*:*:enterprise:windows:*:*",
"matchCriteriaId": "272C2CFE-0D8E-46CE-92B6-2BA8658C951B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2023:patch_3:*:*:enterprise:windows:*:*",
"matchCriteriaId": "91DBE33A-C764-46E7-A86C-8F39A19A3B82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2023:patch_4:*:*:enterprise:windows:*:*",
"matchCriteriaId": "BD48FE50-4825-461E-BE3F-7740B8A5EC7F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2023:patch_5:*:*:enterprise:windows:*:*",
"matchCriteriaId": "57E86313-0DDA-4FBA-89EF-CAAAD27A38CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2021:-:*:*:enterprise:windows:*:*",
"matchCriteriaId": "D8CB1637-AAF0-437A-A900-AA65D2D60299",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2021:patch_1:*:*:enterprise:windows:*:*",
"matchCriteriaId": "0EDF6498-65CF-4569-AA9B-03D0CB79421E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2021:patch_10:*:*:enterprise:windows:*:*",
"matchCriteriaId": "CB84D640-CAB6-4D91-9B24-B87F5FF07A26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2021:patch_11:*:*:enterprise:windows:*:*",
"matchCriteriaId": "C96EAA46-482D-4322-A226-AB5BE8F61276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2021:patch_12:*:*:enterprise:windows:*:*",
"matchCriteriaId": "A13C0501-7C14-4DFE-A3C4-941A479B5D7F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2021:patch_13:*:*:enterprise:windows:*:*",
"matchCriteriaId": "C687581D-C6C2-49C9-8A7D-F9BD6E7EEC77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2021:patch_14:*:*:enterprise:windows:*:*",
"matchCriteriaId": "CB16E82C-5C38-4364-B445-C30FBE429DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2021:patch_15:*:*:enterprise:windows:*:*",
"matchCriteriaId": "B4B3A235-231D-4993-9FE5-51B460C4A4D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2021:patch_16:*:*:enterprise:windows:*:*",
"matchCriteriaId": "DB79992D-7897-42C3-A628-BE64F3727795",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2021:patch_2:*:*:enterprise:windows:*:*",
"matchCriteriaId": "4F9774E8-B376-4644-9EBA-151453142014",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2021:patch_3:*:*:enterprise:windows:*:*",
"matchCriteriaId": "91B6C3BC-0492-4C1A-A790-B859EA0752FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2021:patch_4:*:*:enterprise:windows:*:*",
"matchCriteriaId": "C5BEF48B-C704-4B65-92C2-5373F29073AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2021:patch_5:*:*:enterprise:windows:*:*",
"matchCriteriaId": "D7B66038-D625-40D3-9E5A-E3076D796A47",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2021:patch_6:*:*:enterprise:windows:*:*",
"matchCriteriaId": "67ED13F8-B452-4F90-A492-7D4AEE36A4DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2021:patch_7:*:*:enterprise:windows:*:*",
"matchCriteriaId": "FD56699E-78F3-4FC4-B6A5-8D4759B53DBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2021:patch_8:*:*:enterprise:windows:*:*",
"matchCriteriaId": "235E44C4-2B84-48DE-A534-6081F3DFDE17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2021:patch_9:*:*:enterprise:windows:*:*",
"matchCriteriaId": "19F7DE12-3456-4BE2-92B3-00F29C7E07F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:-:*:*:enterprise:windows:*:*",
"matchCriteriaId": "72D56C24-9CEF-486B-8E46-6111D7B1676A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_1:*:*:enterprise:windows:*:*",
"matchCriteriaId": "338E52B2-AD7D-43F3-B707-E0E5976B269E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_10:*:*:enterprise:windows:*:*",
"matchCriteriaId": "D216C67A-F124-49F0-90EA-B0C8B663D760",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_11:*:*:enterprise:windows:*:*",
"matchCriteriaId": "81D4C015-A0D2-44E8-87B1-5CF790EFDBED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_2:*:*:enterprise:windows:*:*",
"matchCriteriaId": "FA68ADC7-9E20-4BD3-9235-6D76D4519512",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_3:*:*:enterprise:windows:*:*",
"matchCriteriaId": "B41A9B8C-FAD3-46F1-8973-DF1FA408064B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_4:*:*:enterprise:windows:*:*",
"matchCriteriaId": "EE23F5BD-579C-488D-965A-AE916C32976A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_5:*:*:enterprise:windows:*:*",
"matchCriteriaId": "E9C90120-93D1-43B0-B541-F07EB8FD44EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_6:*:*:enterprise:windows:*:*",
"matchCriteriaId": "450F236B-4673-403C-9E23-736C0ED92F6E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_7:*:*:enterprise:windows:*:*",
"matchCriteriaId": "D5E431DE-26E2-4DA2-AD0B-1479D0C95B98",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_8:*:*:enterprise:windows:*:*",
"matchCriteriaId": "0D6F6570-970B-4E49-9D92-65FAFCC71360",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_9:*:*:enterprise:windows:*:*",
"matchCriteriaId": "38116465-3485-44D3-9097-F2C821D8278F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attacker is able to elevate their privilege by tunneling HTTP requests, allowing them to execute HTTP requests on the backend server that hosts the repository application. The fixed versions are August 2023 Patch 2, May 2023 Patch 6, February 2023 Patch 10, November 2022 Patch 12, August 2022 Patch 14, May 2022 Patch 16, February 2022 Patch 15, and November 2021 Patch 17. NOTE: this issue exists because of an incomplete fix for CVE-2023-41265."
},
{
"lang": "es",
"value": "Qlik Sense Enterprise para Windows antes de agosto de 2023 El parche 2 permite la ejecuci\u00f3n remota de c\u00f3digo no autenticado, tambi\u00e9n conocido como QB-21683. Debido a una validaci\u00f3n inadecuada de los encabezados HTTP, un atacante remoto puede elevar su privilegio al canalizar las solicitudes HTTP, lo que le permite ejecutar solicitudes HTTP en el servidor backend que aloja la aplicaci\u00f3n del repositorio. Las versiones corregidas son el parche 2 de agosto de 2023, el parche 6 de mayo de 2023, el parche 10 de febrero de 2023, el parche 12 de noviembre de 2022, el parche 14 de agosto de 2022, el parche 16 de mayo de 2022, el parche 15 de febrero de 2022 y el parche 17 de noviembre de 2021. NOTA: este problema existe debido a una soluci\u00f3n incompleta para CVE-2023-41265."
}
],
"id": "CVE-2023-48365",
"lastModified": "2025-10-31T14:38:18.083",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.1,
"impactScore": 5.8,
"source": "cve@mitre.org",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.1,
"impactScore": 6.0,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-11-15T22:15:28.027",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/tac-p/2120510"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/tac-p/2120510"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"US Government Resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-48365"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-444"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-444"
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
}
FKIE_CVE-2023-41266
Vulnerability from fkie_nvd - Published: 2023-08-29 23:15 - Updated: 2025-10-31 14:42
Severity ?
8.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Summary
A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows an unauthenticated remote attacker to generate an anonymous session. This allows them to transmit HTTP requests to unauthorized endpoints. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | may_2023 | |
| qlik | qlik_sense | may_2023 | |
| qlik | qlik_sense | may_2023 | |
| qlik | qlik_sense | may_2023 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 |
{
"cisaActionDue": "2023-12-28",
"cisaExploitAdd": "2023-12-07",
"cisaRequiredAction": "Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.",
"cisaVulnerabilityName": "Qlik Sense Path Traversal Vulnerability",
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:-:*:*:enterprise:windows:*:*",
"matchCriteriaId": "41AEA1CA-D344-48DB-92D8-05D0EDC8487D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_1:*:*:enterprise:windows:*:*",
"matchCriteriaId": "FC12BB7A-366F-4EE2-AABF-19E83B5B9EC7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_10:*:*:enterprise:windows:*:*",
"matchCriteriaId": "5F601CFC-70D0-450B-AE49-058E6B887E15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_11:*:*:enterprise:windows:*:*",
"matchCriteriaId": "17E7F947-3322-46BB-9B89-689F1B792D89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_12:*:*:enterprise:windows:*:*",
"matchCriteriaId": "37AF6E89-73F0-49E8-82F4-08084A5EBE2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_2:*:*:enterprise:windows:*:*",
"matchCriteriaId": "E4C7CBBB-C6A0-460E-95DC-C1855826C7F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_3:*:*:enterprise:windows:*:*",
"matchCriteriaId": "BD491E32-270C-452B-AC1E-FB8F509B916E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_4:*:*:enterprise:windows:*:*",
"matchCriteriaId": "EDE2809B-4234-443E-9E6A-6B402D258617",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_5:*:*:enterprise:windows:*:*",
"matchCriteriaId": "155F0D6F-2E4A-40E7-9145-7D130334466B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_6:*:*:enterprise:windows:*:*",
"matchCriteriaId": "D733F495-E0EF-4F25-8532-2773415EFB8B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_7:*:*:enterprise:windows:*:*",
"matchCriteriaId": "578092D7-0F52-45C1-B7E2-FC5AF86AB8ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_8:*:*:enterprise:windows:*:*",
"matchCriteriaId": "1B3164BA-0BDB-41F9-B51C-4FB0489A125A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_9:*:*:enterprise:windows:*:*",
"matchCriteriaId": "E0D31C35-50DC-4CDF-AFD4-311EAF5BBBD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:-:*:*:enterprise:windows:*:*",
"matchCriteriaId": "95BBBA68-269F-4385-9D14-A736F2CD707E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_1:*:*:enterprise:windows:*:*",
"matchCriteriaId": "E6E1046C-35F4-451A-BFF1-2FC6EB01B547",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_2:*:*:enterprise:windows:*:*",
"matchCriteriaId": "D9AB037B-EE88-47CD-B387-42651CBAAFF9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_3:*:*:enterprise:windows:*:*",
"matchCriteriaId": "3D28B87A-B36A-428E-A93B-255CFD62036F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_4:*:*:enterprise:windows:*:*",
"matchCriteriaId": "9AD961D6-A315-493C-926F-1441E51C1742",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_5:*:*:enterprise:windows:*:*",
"matchCriteriaId": "1EFEBD77-7968-4649-8E9B-DAB24DC36E64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_6:*:*:enterprise:windows:*:*",
"matchCriteriaId": "E6D033E6-C022-4C6B-9EAC-95ABF6CA9BA6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_7:*:*:enterprise:windows:*:*",
"matchCriteriaId": "761B402F-4E98-46A4-A8E3-87F167CF01D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2023:-:*:*:enterprise:windows:*:*",
"matchCriteriaId": "9E7034FB-5E64-47AD-B4A4-8428474C48C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2023:patch_1:*:*:enterprise:windows:*:*",
"matchCriteriaId": "29158A06-3DE9-487B-9BC5-B4A690864F4F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2023:patch_2:*:*:enterprise:windows:*:*",
"matchCriteriaId": "272C2CFE-0D8E-46CE-92B6-2BA8658C951B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2023:patch3:*:*:enterprise:windows:*:*",
"matchCriteriaId": "039E4C03-89CA-4E77-8D79-39D22E85A299",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:-:*:*:enterprise:windows:*:*",
"matchCriteriaId": "72D56C24-9CEF-486B-8E46-6111D7B1676A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_1:*:*:enterprise:windows:*:*",
"matchCriteriaId": "338E52B2-AD7D-43F3-B707-E0E5976B269E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_10:*:*:enterprise:windows:*:*",
"matchCriteriaId": "D216C67A-F124-49F0-90EA-B0C8B663D760",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_2:*:*:enterprise:windows:*:*",
"matchCriteriaId": "FA68ADC7-9E20-4BD3-9235-6D76D4519512",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_3:*:*:enterprise:windows:*:*",
"matchCriteriaId": "B41A9B8C-FAD3-46F1-8973-DF1FA408064B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_4:*:*:enterprise:windows:*:*",
"matchCriteriaId": "EE23F5BD-579C-488D-965A-AE916C32976A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_5:*:*:enterprise:windows:*:*",
"matchCriteriaId": "E9C90120-93D1-43B0-B541-F07EB8FD44EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_6:*:*:enterprise:windows:*:*",
"matchCriteriaId": "450F236B-4673-403C-9E23-736C0ED92F6E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_7:*:*:enterprise:windows:*:*",
"matchCriteriaId": "D5E431DE-26E2-4DA2-AD0B-1479D0C95B98",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_8:*:*:enterprise:windows:*:*",
"matchCriteriaId": "0D6F6570-970B-4E49-9D92-65FAFCC71360",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_9:*:*:enterprise:windows:*:*",
"matchCriteriaId": "38116465-3485-44D3-9097-F2C821D8278F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows an unauthenticated remote attacker to generate an anonymous session. This allows them to transmit HTTP requests to unauthorized endpoints. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13."
},
{
"lang": "es",
"value": "Una vulnerabilidad de limitaci\u00f3n incorrecta de una ruta a un directorio restringido (path traversal) detectada en Qlik Sense Enterprise para Windows, para las versiones Mayo 2023 Parche 3 y anteriores, Febrero 2023 Parche 7 y anteriores, Noviembre 2022 Parche 10 y anteriores, y Agosto 2022 Parche 12 y anteriores, permite a un atacante remoto no autenticado generar una sesi\u00f3n an\u00f3nima. Esto le permite transmitir peticiones HTTP a endpoints no autorizados. Esto se ha corregido en la IR de Agosto de 2023, el Parche 4 de Mayo de 2023, el Parche 8 de febrero de 2023, el Parche 11 de Noviembre de 2022 y el Parche 13 de Agosto de 2022."
}
],
"id": "CVE-2023-41266",
"lastModified": "2025-10-31T14:42:55.363",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 4.2,
"source": "cve@mitre.org",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 2.5,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-08-29T23:15:09.380",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes"
],
"url": "https://community.qlik.com/t5/Release-Notes/tkb-p/ReleaseNotes"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes"
],
"url": "https://community.qlik.com/t5/Release-Notes/tkb-p/ReleaseNotes"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"US Government Resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41266"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
}
FKIE_CVE-2023-41265
Vulnerability from fkie_nvd - Published: 2023-08-29 23:15 - Updated: 2025-10-31 14:42
Severity ?
9.6 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
9.9 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
9.9 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Summary
An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows a remote attacker to elevate their privilege by tunneling HTTP requests in the raw HTTP request. This allows them to send requests that get executed by the backend server hosting the repository application. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | august_2022 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | february_2023 | |
| qlik | qlik_sense | may_2023 | |
| qlik | qlik_sense | may_2023 | |
| qlik | qlik_sense | may_2023 | |
| qlik | qlik_sense | may_2023 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 | |
| qlik | qlik_sense | november_2022 |
{
"cisaActionDue": "2023-12-28",
"cisaExploitAdd": "2023-12-07",
"cisaRequiredAction": "Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.",
"cisaVulnerabilityName": "Qlik Sense HTTP Tunneling Vulnerability",
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:-:*:*:enterprise:windows:*:*",
"matchCriteriaId": "41AEA1CA-D344-48DB-92D8-05D0EDC8487D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_1:*:*:enterprise:windows:*:*",
"matchCriteriaId": "FC12BB7A-366F-4EE2-AABF-19E83B5B9EC7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_10:*:*:enterprise:windows:*:*",
"matchCriteriaId": "5F601CFC-70D0-450B-AE49-058E6B887E15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_11:*:*:enterprise:windows:*:*",
"matchCriteriaId": "17E7F947-3322-46BB-9B89-689F1B792D89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_12:*:*:enterprise:windows:*:*",
"matchCriteriaId": "37AF6E89-73F0-49E8-82F4-08084A5EBE2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_2:*:*:enterprise:windows:*:*",
"matchCriteriaId": "E4C7CBBB-C6A0-460E-95DC-C1855826C7F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_3:*:*:enterprise:windows:*:*",
"matchCriteriaId": "BD491E32-270C-452B-AC1E-FB8F509B916E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_4:*:*:enterprise:windows:*:*",
"matchCriteriaId": "EDE2809B-4234-443E-9E6A-6B402D258617",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_5:*:*:enterprise:windows:*:*",
"matchCriteriaId": "155F0D6F-2E4A-40E7-9145-7D130334466B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_6:*:*:enterprise:windows:*:*",
"matchCriteriaId": "D733F495-E0EF-4F25-8532-2773415EFB8B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_7:*:*:enterprise:windows:*:*",
"matchCriteriaId": "578092D7-0F52-45C1-B7E2-FC5AF86AB8ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_8:*:*:enterprise:windows:*:*",
"matchCriteriaId": "1B3164BA-0BDB-41F9-B51C-4FB0489A125A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:august_2022:patch_9:*:*:enterprise:windows:*:*",
"matchCriteriaId": "E0D31C35-50DC-4CDF-AFD4-311EAF5BBBD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:-:*:*:enterprise:windows:*:*",
"matchCriteriaId": "95BBBA68-269F-4385-9D14-A736F2CD707E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_1:*:*:enterprise:windows:*:*",
"matchCriteriaId": "E6E1046C-35F4-451A-BFF1-2FC6EB01B547",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_2:*:*:enterprise:windows:*:*",
"matchCriteriaId": "D9AB037B-EE88-47CD-B387-42651CBAAFF9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_3:*:*:enterprise:windows:*:*",
"matchCriteriaId": "3D28B87A-B36A-428E-A93B-255CFD62036F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_4:*:*:enterprise:windows:*:*",
"matchCriteriaId": "9AD961D6-A315-493C-926F-1441E51C1742",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_5:*:*:enterprise:windows:*:*",
"matchCriteriaId": "1EFEBD77-7968-4649-8E9B-DAB24DC36E64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_6:*:*:enterprise:windows:*:*",
"matchCriteriaId": "E6D033E6-C022-4C6B-9EAC-95ABF6CA9BA6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2023:patch_7:*:*:enterprise:windows:*:*",
"matchCriteriaId": "761B402F-4E98-46A4-A8E3-87F167CF01D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2023:-:*:*:enterprise:windows:*:*",
"matchCriteriaId": "9E7034FB-5E64-47AD-B4A4-8428474C48C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2023:patch_1:*:*:enterprise:windows:*:*",
"matchCriteriaId": "29158A06-3DE9-487B-9BC5-B4A690864F4F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2023:patch_2:*:*:enterprise:windows:*:*",
"matchCriteriaId": "272C2CFE-0D8E-46CE-92B6-2BA8658C951B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:may_2023:patch3:*:*:enterprise:windows:*:*",
"matchCriteriaId": "039E4C03-89CA-4E77-8D79-39D22E85A299",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:-:*:*:enterprise:windows:*:*",
"matchCriteriaId": "72D56C24-9CEF-486B-8E46-6111D7B1676A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_1:*:*:enterprise:windows:*:*",
"matchCriteriaId": "338E52B2-AD7D-43F3-B707-E0E5976B269E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_10:*:*:enterprise:windows:*:*",
"matchCriteriaId": "D216C67A-F124-49F0-90EA-B0C8B663D760",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_2:*:*:enterprise:windows:*:*",
"matchCriteriaId": "FA68ADC7-9E20-4BD3-9235-6D76D4519512",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_3:*:*:enterprise:windows:*:*",
"matchCriteriaId": "B41A9B8C-FAD3-46F1-8973-DF1FA408064B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_4:*:*:enterprise:windows:*:*",
"matchCriteriaId": "EE23F5BD-579C-488D-965A-AE916C32976A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_5:*:*:enterprise:windows:*:*",
"matchCriteriaId": "E9C90120-93D1-43B0-B541-F07EB8FD44EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_6:*:*:enterprise:windows:*:*",
"matchCriteriaId": "450F236B-4673-403C-9E23-736C0ED92F6E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_7:*:*:enterprise:windows:*:*",
"matchCriteriaId": "D5E431DE-26E2-4DA2-AD0B-1479D0C95B98",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_8:*:*:enterprise:windows:*:*",
"matchCriteriaId": "0D6F6570-970B-4E49-9D92-65FAFCC71360",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2022:patch_9:*:*:enterprise:windows:*:*",
"matchCriteriaId": "38116465-3485-44D3-9097-F2C821D8278F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows a remote attacker to elevate their privilege by tunneling HTTP requests in the raw HTTP request. This allows them to send requests that get executed by the backend server hosting the repository application. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13."
},
{
"lang": "es",
"value": "Una vulnerabilidad de HTTP Request Tunneling detectada en Qlik Sense Enterprise para Windows, para las versiones Mayo 2023 Parche 3 y anteriores, Febrero 2023 Parche 7 y anteriores, Noviembre 2022 Parche 10 y anteriores, y Agosto 2022 Parche 12 y anteriores permite a un atacante remoto escalar privilegios tunelizando peticiones HTTP en la petici\u00f3n HTTP sin procesar. Esto le permite enviar peticiones que son ejecutadas por el servidor del backend que aloja la aplicaci\u00f3n de repositorio. Esto se soluciona en la versi\u00f3n Agosto de 2023 IR, Mayo de 2023 Parche 4, Febrero de 2023 Parche 8, Noviembre de 2022 Parche 11, y Agosto de 2022 Parche 13."
}
],
"id": "CVE-2023-41265",
"lastModified": "2025-10-31T14:42:59.610",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.1,
"impactScore": 5.8,
"source": "cve@mitre.org",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.1,
"impactScore": 6.0,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-08-29T23:15:09.170",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes"
],
"url": "https://community.qlik.com/t5/Release-Notes/tkb-p/ReleaseNotes"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes"
],
"url": "https://community.qlik.com/t5/Release-Notes/tkb-p/ReleaseNotes"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"US Government Resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41265"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-444"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-444"
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
}
FKIE_CVE-2021-36761
Vulnerability from fkie_nvd - Published: 2022-06-21 17:15 - Updated: 2024-11-21 06:14
Severity ?
Summary
The GeoAnalytics feature in Qlik Sense April 2020 patch 4 allows SSRF.
References
| URL | Tags | ||
|---|---|---|---|
| cve@mitre.org | https://www.cyberiskvision.com/advisory/ | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.cyberiskvision.com/advisory/ | Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| qlik | qlik_sense | april_2020 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:april_2020:patch4:*:*:*:*:*:*",
"matchCriteriaId": "3B7159A4-0AE1-4F36-9EFE-657EF2172988",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The GeoAnalytics feature in Qlik Sense April 2020 patch 4 allows SSRF."
},
{
"lang": "es",
"value": "La funci\u00f3n GeoAnalytics de Qlik Sense versi\u00f3n April 2020 patch 4, permite un ataque de tipo SSRF"
}
],
"id": "CVE-2021-36761",
"lastModified": "2024-11-21T06:14:02.287",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-06-21T17:15:08.073",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.cyberiskvision.com/advisory/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.cyberiskvision.com/advisory/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-918"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2022-0564
Vulnerability from fkie_nvd - Published: 2022-02-21 18:15 - Updated: 2025-04-25 16:15
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Summary
A vulnerability in Qlik Sense Enterprise on Windows could allow an remote attacker to enumerate domain user accounts. An attacker could exploit this vulnerability by sending authentication requests to an affected system. A successful exploit could allow the attacker to compare the response time that are returned by the affected system to determine which accounts are valid user accounts. Affected systems are only vulnerable if they have LDAP configured.
The affected URI is /internal_forms_authentication/ the response time of the form is longer if the supplied user does not exists and shorter if the user exists.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| qlik | qlik_sense | * | |
| microsoft | windows | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:*:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "A11AF1D3-E82C-4C30-BD28-E1A0118D37D5",
"versionEndExcluding": "14.44.0",
"versionStartIncluding": "14.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in Qlik Sense Enterprise on Windows could allow an remote attacker to enumerate domain user accounts. An attacker could exploit this vulnerability by sending authentication requests to an affected system. A successful exploit could allow the attacker to compare the response time that are returned by the affected system to determine which accounts are valid user accounts. Affected systems are only vulnerable if they have LDAP configured.\n\nThe affected URI is /internal_forms_authentication/ the response time of the form is longer if the supplied user does not exists and shorter if the user exists."
},
{
"lang": "es",
"value": "Una vulnerabilidad en Qlik Sense Enterprise en Windows podr\u00eda permitir a un atacante remoto enumerar cuentas de usuario de dominio. Un atacante podr\u00eda explotar esta vulnerabilidad enviando solicitudes de autenticaci\u00f3n a un sistema afectado. Un exploit exitoso podr\u00eda permitir al atacante comparar el tiempo de respuesta que es devuelto por el sistema afectado para determinar qu\u00e9 cuentas son cuentas de usuario v\u00e1lidas. Los sistemas afectados s\u00f3lo son vulnerables si tienen LDAP configurado"
}
],
"id": "CVE-2022-0564",
"lastModified": "2025-04-25T16:15:21.977",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "csirt@divd.nl",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-02-21T18:15:08.873",
"references": [
{
"source": "csirt@divd.nl",
"tags": [
"Release Notes"
],
"url": "https://community.qlik.com/t5/Release-Notes/Qlik-Sense-Enterprise-on-Windows-November-2021-Initial-Release/ta-p/1856531"
},
{
"source": "csirt@divd.nl",
"tags": [
"Third Party Advisory"
],
"url": "https://csirt.divd.nl/CVE-2022-0564/"
},
{
"source": "csirt@divd.nl",
"tags": [
"Third Party Advisory"
],
"url": "https://csirt.divd.nl/DIVD-2021-00021/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes"
],
"url": "https://community.qlik.com/t5/Release-Notes/Qlik-Sense-Enterprise-on-Windows-November-2021-Initial-Release/ta-p/1856531"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://csirt.divd.nl/CVE-2022-0564/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://csirt.divd.nl/DIVD-2021-00021/"
}
],
"sourceIdentifier": "csirt@divd.nl",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-204"
}
],
"source": "csirt@divd.nl",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-203"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2019-11628
Vulnerability from fkie_nvd - Published: 2019-05-01 03:29 - Updated: 2024-11-21 04:21
Severity ?
8.2 (High) - CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
6.5 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
6.5 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Summary
An issue was discovered in QlikView Server before 11.20 SR19, 12.00 and 12.10 before 12.10 SR11, 12.20 before SR9, and 12.30 before SR2; and Qlik Sense Enterprise and Qlik Analytics Platform installations that lack these patch levels: February 2018 Patch 4, April 2018 Patch 3, June 2018 Patch 3, September 2018 Patch 4, November 2018 Patch 4, or February 2019 Patch 2. An authenticated user may be able to bypass intended file-read restrictions via crafted Browser requests.
References
| URL | Tags | ||
|---|---|---|---|
| cve@mitre.org | https://qliksupport.force.com/articles/000069985 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://qliksupport.force.com/articles/000069985 | Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:11.20:service_release_1:*:*:*:*:*:*",
"matchCriteriaId": "70348E24-DF95-4A83-820D-5F3C13055AE5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:11.20:service_release_10:*:*:*:*:*:*",
"matchCriteriaId": "1FBE0588-1011-4616-AF13-5312CDC262F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:11.20:service_release_11:*:*:*:*:*:*",
"matchCriteriaId": "5C258DFA-C6E6-49F1-BE0F-4F1E78EF16B4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:11.20:service_release_12:*:*:*:*:*:*",
"matchCriteriaId": "9D625AA7-2063-45F1-873F-9FE8BD1AD127",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:11.20:service_release_13:*:*:*:*:*:*",
"matchCriteriaId": "ED61447C-30A7-4369-AAB9-AC48B7ECE44C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:11.20:service_release_14:*:*:*:*:*:*",
"matchCriteriaId": "DE8DEAE0-083D-472C-8C89-F6452CA07FA1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:11.20:service_release_15:*:*:*:*:*:*",
"matchCriteriaId": "CA3B6615-A5F6-4DC6-B43B-E3C7D1453D86",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:11.20:service_release_16:*:*:*:*:*:*",
"matchCriteriaId": "44A0F9B9-4169-45AB-A08D-0CD17AE9042E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:11.20:service_release_17:*:*:*:*:*:*",
"matchCriteriaId": "18CD5DDE-EE11-4D84-9830-22190C9D0BAC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:11.20:service_release_2:*:*:*:*:*:*",
"matchCriteriaId": "1E959F54-6B26-47D8-849E-B2D4309CE9FC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:11.20:service_release_3:*:*:*:*:*:*",
"matchCriteriaId": "804B8141-890B-49D3-AAF7-29B82DE458F4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:11.20:service_release_4:*:*:*:*:*:*",
"matchCriteriaId": "09765ABB-8EF3-48B8-A2CB-409574CDD491",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:11.20:service_release_5:*:*:*:*:*:*",
"matchCriteriaId": "CDEA544E-D63B-4797-8BDA-20B7B7BA6FC3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:11.20:service_release_6:*:*:*:*:*:*",
"matchCriteriaId": "843EA971-B23E-4FD9-892D-AB5857C1AE47",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:11.20:service_release_7:*:*:*:*:*:*",
"matchCriteriaId": "A11AC3DC-D026-4E43-9ADE-4E3BF0CC22EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:11.20:service_release_8:*:*:*:*:*:*",
"matchCriteriaId": "44E5CA6C-9991-485F-98A7-7873684175D9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:11.20:service_release_9:*:*:*:*:*:*",
"matchCriteriaId": "D72BC295-687D-49AE-AB08-7A54F81066FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:12.00:*:*:*:*:*:*:*",
"matchCriteriaId": "1EC12134-E1F6-411B-962C-EC0F733FE9A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:12.10:service_release_1:*:*:*:*:*:*",
"matchCriteriaId": "DE1C9243-C526-4495-85EE-9DFF39E3747E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:12.10:service_release_2:*:*:*:*:*:*",
"matchCriteriaId": "76806FB7-5A08-4208-990F-5A255F74C3E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:12.10:service_release_3:*:*:*:*:*:*",
"matchCriteriaId": "2C8950D8-E839-4A57-BA91-86CAA412FE79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:12.10:service_release_4:*:*:*:*:*:*",
"matchCriteriaId": "7F9C80CC-F74C-4FB8-946E-CB56C9EF1521",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:12.10:service_release_5:*:*:*:*:*:*",
"matchCriteriaId": "E2D58713-EDA5-49C5-92FB-F34292DED794",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:12.10:service_release_6:*:*:*:*:*:*",
"matchCriteriaId": "9DC4C1E3-401B-48DC-9E34-FB0805ADB1CC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:12.10:service_release_7:*:*:*:*:*:*",
"matchCriteriaId": "F51220EF-9CCB-4A52-8F8D-11A1141F2C21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:12.10:service_release_8:*:*:*:*:*:*",
"matchCriteriaId": "89E647FE-5A80-4455-AABA-F07B08A38641",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:12.10:service_release_9:*:*:*:*:*:*",
"matchCriteriaId": "CAF8B5BB-EA7C-4973-8095-5E8BDA6076D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:12.20:service_release_1:*:*:*:*:*:*",
"matchCriteriaId": "93B22D9A-4F9C-43A5-9C06-8102507FD4EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:12.20:service_release_2:*:*:*:*:*:*",
"matchCriteriaId": "580CD55F-DE41-41B4-AA0E-996E670C408F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:12.20:service_release_3:*:*:*:*:*:*",
"matchCriteriaId": "1532D2D2-F60B-4E75-89EF-706013FB3DBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:12.20:service_release_4:*:*:*:*:*:*",
"matchCriteriaId": "FE2C1342-1417-47FB-A4FB-FFAF66AC778F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlikview_server:12.30:service_release_1:*:*:*:*:*:*",
"matchCriteriaId": "873637C6-ADFE-4A15-9D33-F8D1092755B0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:qlik:qlik_analytics:april_2018:*:*:*:*:*:*:*",
"matchCriteriaId": "0B18B725-BDC3-4D09-A394-357294899ADF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_analytics:february_2018:*:*:*:*:*:*:*",
"matchCriteriaId": "58B51434-6094-41A3-8A2A-8E6BEBCAFF8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_analytics:february_2019:*:*:*:*:*:*:*",
"matchCriteriaId": "52B01CFC-4052-47B3-AE3F-C35C6CB2420A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_analytics:june_2017:*:*:*:*:*:*:*",
"matchCriteriaId": "5A717032-F242-4FBC-B161-0468D93C62C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_analytics:june_2018:*:*:*:*:*:*:*",
"matchCriteriaId": "0090402D-58DF-4789-B58A-578B9F12AEAC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_analytics:november_2017:*:*:*:*:*:*:*",
"matchCriteriaId": "2BAE1CAC-960E-4D47-B51E-B059DDB0359D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_analytics:november_2018:*:*:*:*:*:*:*",
"matchCriteriaId": "4304015D-9F88-42BC-A47E-AE97B4E376EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_analytics:september_2017:*:*:*:*:*:*:*",
"matchCriteriaId": "04DAA0C1-C364-4569-8FA4-610CD1E36CED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_analytics:september_2018:*:*:*:*:*:*:*",
"matchCriteriaId": "FE495C90-D556-466D-AABF-5C63641A7B43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:april_2018:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "F70CE603-B271-4388-9807-C443356277B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2018:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "2CA0BCEC-51E6-485B-8149-2703E24249A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:february_2019:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "A1C4A9DD-6B2D-400E-88B0-5D923CAC2118",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:june_2017:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "F12B37BF-9FC8-4FED-90A8-73553E7E517B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:june_2018:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "6DB72ED4-AD95-4A05-99B7-BA1C13565CA3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2017:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "AD584882-AF47-4219-BA91-0A6BD2120F3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:november_2018:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "72BD1752-05AE-42CF-BA4E-1036A269C96D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:september_2017:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "CA72F3BE-791D-4D7B-925C-2B1E93319EA9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qlik:qlik_sense:september_2018:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "2B0543DF-9C64-4545-996E-6B5B572A52AA",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in QlikView Server before 11.20 SR19, 12.00 and 12.10 before 12.10 SR11, 12.20 before SR9, and 12.30 before SR2; and Qlik Sense Enterprise and Qlik Analytics Platform installations that lack these patch levels: February 2018 Patch 4, April 2018 Patch 3, June 2018 Patch 3, September 2018 Patch 4, November 2018 Patch 4, or February 2019 Patch 2. An authenticated user may be able to bypass intended file-read restrictions via crafted Browser requests."
},
{
"lang": "es",
"value": "Fue encontrado un problema en QlikView Server versi\u00f3n anterior a 11.20 SR19, versi\u00f3n 12.00 y versi\u00f3n 12.10 anterior a 12.10 SR11, versi\u00f3n 12.20 anterior a SR9 y versi\u00f3n 12.30 anterior a SR2; y Qlik Sense Enterprise y Qlik Analytics Platform, ya que se presentan instalaciones q carecen de estos niveles de path: febrero de 2018 path 4, abril de 2018 path 3, junio de 2018 path 3, septiembre de 2018 path 4, noviembre de 2018 path 4 o febrero de 2019 path 2. Un usuario identificado puede ser capaz de omitir las restricciones de lectura de archivos previstas por medio de petici\u00f3nes de navegador creadas."
}
],
"id": "CVE-2019-11628",
"lastModified": "2024-11-21T04:21:29.393",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.0"
},
"exploitabilityScore": 1.8,
"impactScore": 5.8,
"source": "cve@mitre.org",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-05-01T03:29:00.230",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://qliksupport.force.com/articles/000069985"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://qliksupport.force.com/articles/000069985"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-917"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
CVE-2025-61138 (GCVE-0-2025-61138)
Vulnerability from cvelistv5 – Published: 2025-11-20 00:00 – Updated: 2025-11-21 16:03
VLAI?
Summary
Qlik Sense Enterprise v14.212.13 was discovered to contain an information leak via the /dev-hub/ directory.
Severity ?
7.5 (High)
CWE
- n/a
Assigner
References
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-61138",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-21T15:58:02.383680Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-538",
"description": "CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-21T16:03:38.792Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Qlik Sense Enterprise v14.212.13 was discovered to contain an information leak via the /dev-hub/ directory."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-20T21:20:44.014Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://gist.github.com/Israel0x00/8a81ec98162e9ca8e4a3a6c8b4ef4762"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2025-61138",
"datePublished": "2025-11-20T00:00:00.000Z",
"dateReserved": "2025-09-26T00:00:00.000Z",
"dateUpdated": "2025-11-21T16:03:38.792Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-48365 (GCVE-0-2023-48365)
Vulnerability from cvelistv5 – Published: 2023-11-15 00:00 – Updated: 2025-10-21 23:05
VLAI?
Summary
Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attacker is able to elevate their privilege by tunneling HTTP requests, allowing them to execute HTTP requests on the backend server that hosts the repository application. The fixed versions are August 2023 Patch 2, May 2023 Patch 6, February 2023 Patch 10, November 2022 Patch 12, August 2022 Patch 14, May 2022 Patch 16, February 2022 Patch 15, and November 2021 Patch 17. NOTE: this issue exists because of an incomplete fix for CVE-2023-41265.
Severity ?
9.6 (Critical)
CWE
- n/a
Assigner
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T21:30:34.616Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/tac-p/2120510"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-48365",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-13T15:33:34.009005Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2025-01-13",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-48365"
},
"type": "kev"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444 Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-21T23:05:32.191Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-48365"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-01-13T00:00:00+00:00",
"value": "CVE-2023-48365 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attacker is able to elevate their privilege by tunneling HTTP requests, allowing them to execute HTTP requests on the backend server that hosts the repository application. The fixed versions are August 2023 Patch 2, May 2023 Patch 6, February 2023 Patch 10, November 2022 Patch 12, August 2022 Patch 14, May 2022 Patch 16, February 2022 Patch 15, and November 2021 Patch 17. NOTE: this issue exists because of an incomplete fix for CVE-2023-41265."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AC:L/AV:N/A:N/C:H/I:H/PR:L/S:C/UI:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-11-15T21:15:52.732Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/tac-p/2120510"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-48365",
"datePublished": "2023-11-15T00:00:00.000Z",
"dateReserved": "2023-11-15T00:00:00.000Z",
"dateUpdated": "2025-10-21T23:05:32.191Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-41265 (GCVE-0-2023-41265)
Vulnerability from cvelistv5 – Published: 2023-08-29 00:00 – Updated: 2025-10-30 16:25
VLAI?
Summary
An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows a remote attacker to elevate their privilege by tunneling HTTP requests in the raw HTTP request. This allows them to send requests that get executed by the backend server hosting the repository application. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.
Severity ?
9.6 (Critical)
CWE
- n/a
Assigner
References
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:qlik:qlik_sense:may_2023:-:*:*:enterprise:windows:*:*"
],
"defaultStatus": "unknown",
"product": "qlik_sense",
"vendor": "qlik",
"versions": [
{
"lessThanOrEqual": "may_2023",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:qlik:qlik_sense:february_2023:patch_7:*:*:enterprise:windows:*:*"
],
"defaultStatus": "unknown",
"product": "qlik_sense",
"vendor": "qlik",
"versions": [
{
"lessThanOrEqual": "february_2023",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:qlik:qlik_sense:august_2022:patch_12:*:*:enterprise:windows:*:*"
],
"defaultStatus": "unknown",
"product": "qlik_sense",
"vendor": "qlik",
"versions": [
{
"lessThanOrEqual": "august_2022",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-41265",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-23T04:01:03.009998Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2023-12-07",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41265"
},
"type": "kev"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444 Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-30T16:25:59.533Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41265"
}
],
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:54:05.059Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://community.qlik.com/t5/Release-Notes/tkb-p/ReleaseNotes"
},
{
"tags": [
"x_transferred"
],
"url": "https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows a remote attacker to elevate their privilege by tunneling HTTP requests in the raw HTTP request. This allows them to send requests that get executed by the backend server hosting the repository application. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AC:L/AV:N/A:N/C:H/I:H/PR:L/S:C/UI:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-08-29T22:34:49.015Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://community.qlik.com/t5/Release-Notes/tkb-p/ReleaseNotes"
},
{
"url": "https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-41265",
"datePublished": "2023-08-29T00:00:00.000Z",
"dateReserved": "2023-08-25T00:00:00.000Z",
"dateUpdated": "2025-10-30T16:25:59.533Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-41266 (GCVE-0-2023-41266)
Vulnerability from cvelistv5 – Published: 2023-08-29 00:00 – Updated: 2025-10-30 15:32
VLAI?
Summary
A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows an unauthenticated remote attacker to generate an anonymous session. This allows them to transmit HTTP requests to unauthorized endpoints. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.
Severity ?
8.2 (High)
CWE
- n/a
Assigner
References
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:qlik:qlik_sense:august_2022:patch_12:*:*:enterprise:windows:*:*"
],
"defaultStatus": "unknown",
"product": "qlik_sense",
"vendor": "qlik",
"versions": [
{
"lessThanOrEqual": "august_2022",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:qlik:qlik_sense:may_2023:patch3:*:*:enterprise:windows:*:*"
],
"defaultStatus": "unknown",
"product": "qlik_sense",
"vendor": "qlik",
"versions": [
{
"lessThanOrEqual": "may_2023",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:qlik:qlik_sense:february_2023:patch_7:*:*:enterprise:windows:*:*"
],
"defaultStatus": "unknown",
"product": "qlik_sense",
"vendor": "qlik",
"versions": [
{
"lessThanOrEqual": "february_2023",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:qlik:qlik_sense:november_2022:patch_10:*:*:enterprise:windows:*:*"
],
"defaultStatus": "unknown",
"product": "qlik_sense",
"vendor": "qlik",
"versions": [
{
"lessThanOrEqual": "november_2022",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-41266",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-23T04:01:03.822744Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2023-12-07",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41266"
},
"type": "kev"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-30T15:32:22.573Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41266"
}
],
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:54:04.991Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://community.qlik.com/t5/Release-Notes/tkb-p/ReleaseNotes"
},
{
"tags": [
"x_transferred"
],
"url": "https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows an unauthenticated remote attacker to generate an anonymous session. This allows them to transmit HTTP requests to unauthorized endpoints. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AC:L/AV:N/A:N/C:H/I:L/PR:N/S:U/UI:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-08-29T22:34:56.594Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://community.qlik.com/t5/Release-Notes/tkb-p/ReleaseNotes"
},
{
"url": "https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-41266",
"datePublished": "2023-08-29T00:00:00.000Z",
"dateReserved": "2023-08-25T00:00:00.000Z",
"dateUpdated": "2025-10-30T15:32:22.573Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2021-36761 (GCVE-0-2021-36761)
Vulnerability from cvelistv5 – Published: 2022-06-21 16:07 – Updated: 2024-08-04 01:01
VLAI?
Summary
The GeoAnalytics feature in Qlik Sense April 2020 patch 4 allows SSRF.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T01:01:59.307Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.cyberiskvision.com/advisory/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The GeoAnalytics feature in Qlik Sense April 2020 patch 4 allows SSRF."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-21T16:07:30",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.cyberiskvision.com/advisory/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-36761",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The GeoAnalytics feature in Qlik Sense April 2020 patch 4 allows SSRF."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cyberiskvision.com/advisory/",
"refsource": "MISC",
"url": "https://www.cyberiskvision.com/advisory/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-36761",
"datePublished": "2022-06-21T16:07:30",
"dateReserved": "2021-07-16T00:00:00",
"dateUpdated": "2024-08-04T01:01:59.307Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-0564 (GCVE-0-2022-0564)
Vulnerability from cvelistv5 – Published: 2022-02-21 00:00 – Updated: 2025-04-25 15:46
VLAI?
Summary
A vulnerability in Qlik Sense Enterprise on Windows could allow an remote attacker to enumerate domain user accounts. An attacker could exploit this vulnerability by sending authentication requests to an affected system. A successful exploit could allow the attacker to compare the response time that are returned by the affected system to determine which accounts are valid user accounts. Affected systems are only vulnerable if they have LDAP configured.
The affected URI is /internal_forms_authentication/ the response time of the form is longer if the supplied user does not exists and shorter if the user exists.
Severity ?
5.3 (Medium)
CWE
- CWE-204 - Observable Response Discrepancy
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Qlik Sense | Qlik Sense Enterprise on Windows |
Affected:
14.x , < 14.44.0
(custom)
|
Credits
Hidde Smit (DIVD)
Diego Klinkhamer (DIVD)
Frank Breedijk (DIVD)
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T23:32:46.219Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"third-party-advisory",
"x_transferred"
],
"url": "https://csirt.divd.nl/DIVD-2021-00021/"
},
{
"tags": [
"third-party-advisory",
"x_transferred"
],
"url": "https://csirt.divd.nl/CVE-2022-0564/"
},
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://community.qlik.com/t5/Release-Notes/Qlik-Sense-Enterprise-on-Windows-November-2021-Initial-Release/ta-p/1856531"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Qlik Sense Enterprise on Windows",
"vendor": "Qlik Sense",
"versions": [
{
"lessThan": "14.44.0",
"status": "affected",
"version": "14.x",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Hidde Smit (DIVD)"
},
{
"lang": "en",
"type": "analyst",
"value": "Diego Klinkhamer (DIVD)"
},
{
"lang": "en",
"type": "analyst",
"value": "Frank Breedijk (DIVD)"
}
],
"datePublic": "2022-02-20T23:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability in Qlik Sense Enterprise on Windows could allow an remote attacker to enumerate domain user accounts. An attacker could exploit this vulnerability by sending authentication requests to an affected system. A successful exploit could allow the attacker to compare the response time that are returned by the affected system to determine which accounts are valid user accounts. Affected systems are only vulnerable if they have LDAP configured.\u003cbr\u003e\u003cbr\u003eThe affected URI is /internal_forms_authentication/ the response time of the form is longer if the supplied user does not exists and shorter if the user exists."
}
],
"value": "A vulnerability in Qlik Sense Enterprise on Windows could allow an remote attacker to enumerate domain user accounts. An attacker could exploit this vulnerability by sending authentication requests to an affected system. A successful exploit could allow the attacker to compare the response time that are returned by the affected system to determine which accounts are valid user accounts. Affected systems are only vulnerable if they have LDAP configured.\n\nThe affected URI is /internal_forms_authentication/ the response time of the form is longer if the supplied user does not exists and shorter if the user exists."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-204",
"description": "CWE-204: Observable Response Discrepancy",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-25T15:46:06.267Z",
"orgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
"shortName": "DIVD"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://csirt.divd.nl/DIVD-2021-00021/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://csirt.divd.nl/CVE-2022-0564/"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://community.qlik.com/t5/Release-Notes/Qlik-Sense-Enterprise-on-Windows-November-2021-Initial-Release/ta-p/1856531"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpdate Qlik Sense Enterprise on Windows to version 14.44.0 or higher.\u003c/p\u003e"
}
],
"value": "Update Qlik Sense Enterprise on Windows to version 14.44.0 or higher."
}
],
"source": {
"advisory": "DIVD-2021-00021",
"discovery": "INTERNAL"
},
"title": "Qlik Sense Enterprise Domain User enumeration",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eDisable internet-facing NTLM endpoints, e.g. internal_windows_authentication, to avoid domain enumeration.\u003c/p\u003e"
}
],
"value": "Disable internet-facing NTLM endpoints, e.g. internal_windows_authentication, to avoid domain enumeration."
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
}
}
},
"cveMetadata": {
"assignerOrgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
"assignerShortName": "DIVD",
"cveId": "CVE-2022-0564",
"datePublished": "2022-02-21T00:00:00",
"dateReserved": "2022-02-10T00:00:00",
"dateUpdated": "2025-04-25T15:46:06.267Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-11628 (GCVE-0-2019-11628)
Vulnerability from cvelistv5 – Published: 2019-05-01 02:07 – Updated: 2024-08-04 22:55
VLAI?
Summary
An issue was discovered in QlikView Server before 11.20 SR19, 12.00 and 12.10 before 12.10 SR11, 12.20 before SR9, and 12.30 before SR2; and Qlik Sense Enterprise and Qlik Analytics Platform installations that lack these patch levels: February 2018 Patch 4, April 2018 Patch 3, June 2018 Patch 3, September 2018 Patch 4, November 2018 Patch 4, or February 2019 Patch 2. An authenticated user may be able to bypass intended file-read restrictions via crafted Browser requests.
Severity ?
8.2 (High)
CWE
- n/a
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T22:55:41.045Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://qliksupport.force.com/articles/000069985"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in QlikView Server before 11.20 SR19, 12.00 and 12.10 before 12.10 SR11, 12.20 before SR9, and 12.30 before SR2; and Qlik Sense Enterprise and Qlik Analytics Platform installations that lack these patch levels: February 2018 Patch 4, April 2018 Patch 3, June 2018 Patch 3, September 2018 Patch 4, November 2018 Patch 4, or February 2019 Patch 2. An authenticated user may be able to bypass intended file-read restrictions via crafted Browser requests."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AC:H/AV:N/A:N/C:H/I:H/PR:L/S:C/UI:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-05-01T02:07:47",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://qliksupport.force.com/articles/000069985"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-11628",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in QlikView Server before 11.20 SR19, 12.00 and 12.10 before 12.10 SR11, 12.20 before SR9, and 12.30 before SR2; and Qlik Sense Enterprise and Qlik Analytics Platform installations that lack these patch levels: February 2018 Patch 4, April 2018 Patch 3, June 2018 Patch 3, September 2018 Patch 4, November 2018 Patch 4, or February 2019 Patch 2. An authenticated user may be able to bypass intended file-read restrictions via crafted Browser requests."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AC:H/AV:N/A:N/C:H/I:H/PR:L/S:C/UI:N",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://qliksupport.force.com/articles/000069985",
"refsource": "MISC",
"url": "https://qliksupport.force.com/articles/000069985"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-11628",
"datePublished": "2019-05-01T02:07:47",
"dateReserved": "2019-04-30T00:00:00",
"dateUpdated": "2024-08-04T22:55:41.045Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}