Description

Qlik Sense Enterprise has an authentication bypass vulnerability. An attacker can bypass the authentication with a specially crafted path and get an anonymous session.

Remediation

Upgrade to the latest version of Qlik Sense

References

Critical Security fixes for Qlik Sense Enterprise for Windows (CVE-2023-41266, CVE-2023-41265)

ZeroQlik: Achieving Unauthenticated Remote Code Execution via HTTP Request Tunneling and Path Traversal

Related Vulnerabilities

Moodle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-36568)

Jenkins Improper Authentication Vulnerability (CVE-2014-2062)

WordPress Ultimate Member Plugin Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-24306)

WordPress Plugin YITH WooCommerce Waiting List Security Bypass (1.3.9)

qdPM Code Execution Vulnerability (CVE-2015-3884)

Severity

High

Classification

CVE-2023-41266 CWE-20 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Authentication Bypass Known Vulnerabilities