Description

Qlik Sense Enterprise has an authentication bypass vulnerability. An attacker can bypass the authentication with a specially crafted path and get an anonymous session.

Remediation

Upgrade to the latest version of Qlik Sense

References

Critical Security fixes for Qlik Sense Enterprise for Windows (CVE-2023-41266, CVE-2023-41265)

ZeroQlik: Achieving Unauthenticated Remote Code Execution via HTTP Request Tunneling and Path Traversal

Related Vulnerabilities

WordPress Other Vulnerability (CVE-2007-4153)

WebLogic CVE-2021-35620 Vulnerability (CVE-2021-35620)

PHP Use of Insufficiently Random Values Vulnerability (CVE-2023-3247)

Magento Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-9691)

XOOPS Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2017-11174)

Severity

High

Classification

CVE-2023-41266 CWE-20 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Authentication Bypass Known Vulnerabilities