Detections
Analytics
Qlik Sense Enterprise Path Traversal
critical Web App Scanning Plugin ID 114369
Language:
Synopsis
Qlik Sense Enterprise Path TraversalDescription
Qlik Sense Enterprise for Windows is affected by a Path Traversal as well as an HTTP Request Smuggling, under specific conditions, the second vulnerability can be used to obtain an unauthenticated Remote Code Execution.Solution
Refer to the Qlik advisory for mitigation options.See Also
Plugin Details
Severity: Critical
ID: 114369
Type: remote
Family: Component Vulnerability
Published: 7/18/2024
Updated: 7/18/2024
Scan Template: basic, full, pci, scan
Risk Information
VPR
Risk Factor: High
Score: 8.1
CVSS v2
Risk Factor: High
Base Score: 9
Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C
CVSS Score Source: CVE-2023-41265
CVSS v3
Risk Factor: Critical
Base Score: 9.9
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS Score Source: CVE-2023-41265
Vulnerability Information
CPE: cpe:2.3:a:qlik:qlik_sense:*:*:*:*:*:*:*:*
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 8/29/2023
Vulnerability Publication Date: 8/29/2023
CISA Known Exploited Vulnerability Due Dates: 12/28/2023
Reference Information
CVE: CVE-2023-41265, CVE-2023-41266
OWASP: 2010-A4, 2013-A4, 2013-A9, 2017-A5, 2017-A9, 2021-A3, 2021-A4, 2021-A6
WASC: HTTP Request Smuggling, Improper Input Handling
CAPEC: 10, 101, 104, 105, 108, 109, 110, 120, 13, 135, 136, 14, 153, 182, 209, 22, 23, 230, 231, 24, 250, 261, 267, 28, 3, 31, 33, 42, 43, 45, 46, 47, 473, 52, 53, 588, 63, 64, 67, 7, 71, 72, 73, 78, 79, 8, 80, 81, 83, 85, 88, 9
DISA STIG: APSC-DV-002560, APSC-DV-002630
HIPAA: 164.306(a)(1), 164.306(a)(2), 164.312(a)(1), 164.312(e)
ISO: 27001-A.13.1.3, 27001-A.13.2.1, 27001-A.14.1.2, 27001-A.14.1.3, 27001-A.14.2.5
NIST: sp800_53-AC-4, sp800_53-CM-6b, sp800_53-SI-10
OWASP API: 2019-API7, 2023-API8
OWASP ASVS: 4.0.2-14.2.1, 4.0.2-5.1.3