Descripción
Qlik Sense contains a path traversal vulnerability that allows a remote, unauthenticated attacker to create an anonymous session by sending maliciously crafted HTTP requests. This anonymous session could allow the attacker to send further requests to unauthorized endpoints.
Acción recomendada
Aplicar las correcciones o mitigaciones del fabricante; si no están disponibles, discontinuar el uso del producto.
Referencias
- Aviso de community.qlik.com community.qlik.com/t5/Official-Support-Articles/Critical-Security-fix…
- Ficha en NVD (NIST) nvd.nist.gov/vuln/detail/CVE-2023-41266
Otras vulnerabilidades de Qlik en el catálogo
- CVE-2023-48365 Qlik Sense HTTP Tunneling Vulnerability Alta 13-01-2025
- CVE-2023-41265 Qlik Sense HTTP Tunneling Vulnerability Alta 07-12-2023