Unrated severityCISA KEVNVD Advisory· Published Nov 15, 2023· Updated Oct 21, 2025

CVE-2023-48365

Description

Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attacker is able to elevate their privilege by tunneling HTTP requests, allowing them to execute HTTP requests on the backend server that hosts the repository application. The fixed versions are August 2023 Patch 2, May 2023 Patch 6, February 2023 Patch 10, November 2022 Patch 12, August 2022 Patch 14, May 2022 Patch 16, February 2022 Patch 15, and November 2021 Patch 17. NOTE: this issue exists because of an incomplete fix for CVE-2023-41265.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Qlik/Qlik Sense Enterprise for Windowscpe-rescue2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: < August 2023 Patch 2

Patches

Vulnerability mechanics

References

community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/tac-p/2120510mitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.020
exploit	0.000
kev	0.120
patch	0.000
ransomware	0.060