CVE-2023-41266 Qlik Sense Path Traversal
Unauthenticated attackers can exploit path traversal to generate anonymous sessions and access unauthorized endpoints in Qlik Sense Enterprise.
- Exploited in the wild
- Since 7 Dec 2023
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-41266?
CVE-2023-41266 is a high-severity path traversal vulnerability in n/a, published on 29 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows an unauthenticated remote attacker to generate an anonymous session. This allows them to transmit HTTP requests to unauthorized endpoints. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.
Weakness: CWE-22
Which versions are affected by CVE-2023-41266?
It affects 1 product.
Products include Qlik Qlik Sense.
How do I fix CVE-2023-41266?
No fix has been published for CVE-2023-41266 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 28 Dec 2023.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-41266 being exploited?
Yes. Attackers have exploited CVE-2023-41266 in the wild since at least 7 Dec 2023, including in ransomware campaigns.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in n/a
Sources
Also known as GHSA-fxf5-c62c-5f69.