{"id":"CVE-2023-48365","published":"2023-11-15T22:15:28Z","modified":"2026-06-17T06:34:06Z","title":"Qlik Sense HTTP Tunneling Vulnerability","vendor":"Qlik","product":"Sense","tier":"core","eol":null,"description":{"text":"Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attacker is able to elevate their privilege by tunneling HTTP requests, allowing them to execute HTTP requests on the backend server that hosts the repository application. The fixed versions are August 2023 Patch 2, May 2023 Patch 6, February 2023 Patch 10, November 2022 Patch 12, August 2022 Patch 14, May 2022 Patch 16, February 2022 Patch 15, and November 2021 Patch 17. NOTE: this issue exists because of an incomplete fix for CVE-2023-41265.","provenance":"source","from":"NVD"},"summary":{"text":"Qlik Sense Enterprise for Windows, prior to the August 2023 Patch 2, contains an HTTP tunneling flaw caused by improper validation of HTTP headers in the component that handles HTTP requests to the repository application. An attacker with network access to the server can tunnel HTTP requests to reach and execute requests on the backend server hosting the repository application, which leads to remote code execution and privilege elevation, with the attacker requiring low privileges and no user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T08:32:01Z"},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.47733,"percentile":0.98847,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2025-01-13","dueDate":"2025-02-03","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/tac-p/2120510 ; https://nvd.nist.gov/vuln/detail/CVE-2023-48365","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-11-28","exploitedFirstSeen":"2023-11-28","ransomware":true,"evidence":[{"url":"https://www.arcticwolf.com/resources/blog/qlik-sense-exploited-in-cactus-ransomware-campaign/","date":"2023-11-28"},{"url":"https://research.checkpoint.com/2024/magnet-goblin-targets-publicly-facing-servers-using-1-day-vulnerabilities/","date":"2024-03-08"},{"url":"https://northwave-cybersecurity.com/whitepapers-articles/pricksense-how-cactus-exploits-qlik-sense","date":"2024-04-25"},{"url":"https://www.trustwave.com/hubfs/Web/Library/Documents_pdf/2024_Trustwave_Professional_Services_Sector_Threat_Landscape.pdf","date":"2024-06-26"},{"url":"https://www.orangecyberdefense.com/fileadmin/general/pdf/Cy-Xplorer-2024.pdf","date":"2024-07-08"},{"url":"https://attackerkb.com/topics/1HzZGd2EN4/cve-2023-48365#exploited-in-the-wild_9c3c0bdd-7a98-48de-a889-f351a2aec7cf","date":"2024-12-05"},{"url":"https://www.rapid7.com/blog/post/2024/12/16/2024-threat-landscape-statistics-ransomware-activity-vulnerability-exploits-and-attack-trends/","date":"2024-12-16"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-01-13"},{"url":"https://www.shadowserver.org/what-we-do/network-reporting/compromised-website-report/","date":"2025-02-05"},{"url":"https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/67b5c5f85bac8f34e1b44d35_Darktrace%20Annual%20Threat%20Report%202024.pdf","date":"2025-02-19"}],"evidenceTotal":12,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-444","name":"Inconsistent Interpretation of HTTP Requests"}],"references":[{"url":"https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/tac-p/2120510","tags":["Vendor Advisory"]},{"url":"https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/tac-p/2120510","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-48365","tags":["US Government Resource"]}],"techniques":[{"id":"T1133","name":"External Remote Services","tactics":["initial-access","persistence"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Other","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability stems from improper HTTP header validation, if exploited, allows for remote code execution on affected devices.","confidence":"medium","confidenceNote":"CTID KEV capability group \"other\" is generic"},{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Other","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability stems from improper HTTP header validation, if exploited, allows for remote code execution on affected devices.","confidence":"medium","confidenceNote":"CTID KEV capability group \"other\" is generic"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Other","mappingType":"primary_impact","evidence":[],"comment":"This vulnerability stems from improper HTTP header validation, if exploited, allows for remote code execution on affected devices.","confidence":"medium","confidenceNote":"CTID KEV capability group \"other\" is generic"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-52419","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-52419","exploited":true,"exploitedSince":"2025-01-13","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1133","T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1059"],"provenance":"source"}],"timeline":[{"date":"2023-11-15","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-48365","provenance":"source"},{"date":"2023-11-28","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.arcticwolf.com/resources/blog/qlik-sense-exploited-in-cactus-ransomware-campaign/","provenance":"source"},{"date":"2025-01-13","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-01-13","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-52419","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":425},"priority":{"score":74.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1067 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.77,"detail":"percentile 0.9885"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.93,"detail":"base score 9.9"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-qlik-sense-cve-2023-41265","parents":[{"from":"CVE-2023-41265","to":"CVE-2023-48365","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this issue exists because of an incomplete fix for CVE-2023-41265.","from":"NVD","in":"CVE-2023-48365"},{"kind":"similar","provenance":"machine","score":0.86,"basis":"same product + CWE + description similarity"}]}]}}