Qlik Sense Enterprise on Windows HTTP Request path traversal

Summaryinfo

A vulnerability identified as critical has been detected in Qlik Sense Enterprise on Windows. The impacted element is an unknown function of the component HTTP Request Handler. The manipulation leads to path traversal. This vulnerability is traded as CVE-2023-41266. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability was found in Qlik Sense Enterprise on Windows (affected version not known) and classified as critical. This issue affects some unknown functionality of the component HTTP Request Handler. The manipulation with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows an unauthenticated remote attacker to generate an anonymous session. This allows them to transmit HTTP requests to unauthorized endpoints. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.

The weakness was shared 08/30/2023. The advisory is shared at community.qlik.com. The identification of this vulnerability is CVE-2023-41266 since 08/25/2023. Technical details are unknown but an exploit is available. MITRE ATT&CK project uses the attack technique T1006 for this issue.

It is declared as attacked. The CISA Known Exploited Vulnerabilities Catalog lists this issue since 12/07/2023 with a due date of 12/28/2023:

Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at community.qlik.com.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Qlik

Name

• Sense Enterprise

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion