Critical Β· published August 30, 2023
CVSS calls it critical at 9.6. It is confirmed in active exploitation. It sits in the 99.8th percentile for exploit probability.
π¨ An HTTP request tunneling vulnerability lets a remote attacker elevate their privileges in Qlik Sense like a sneaky guest slipping into a restricted area at a party! π₯ Think of it as a delivery driver whoβs supposed to drop off a package at a specific address but instead delivers it straight to the VIP lounge β unauthorized access in the blink of an eye! If exploited, this vulnerability could allow an attacker to execute unauthorized commands on the backend server, potentially leading to data breaches or even complete control over the application. Thatβs absolutely devastating! Imagine the chaos if malicious actors could access sensitive data or manipulate system settings at will.
Think of it as a delivery driver whoβs supposed to drop off a package at a specific address but instead delivers it straight to the VIP lounge β unauthorized access in the blink of an eye! This vulnerability in Qlik Sense Enterprise enables attackers to tunnel HTTP requests through raw HTTP, allowing them to bypass normal access controls and execute commands on the server.
If exploited, this vulnerability could allow an attacker to execute unauthorized commands on the backend server, potentially leading to data breaches or even complete control over the application. Thatβs absolutely devastating! Imagine the chaos if malicious actors could access sensitive data or manipulate system settings at will. To protect your systems, update to the August 2023 IR or appropriate patches (May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13) immediately. Conduct a thorough security audit to ensure that no unauthorized access points remain. π‘οΈ You've got this! Follow these steps, and youβll be on your way to fortifying your defenses in no time! πͺβ¨
| Product | Versions | Fixed in |
|---|---|---|
| qlik/qlik_sense | all versions | β |
| qlik/qlik_sense | all versions | β |
| qlik/qlik_sense | all versions | β |
| qlik/qlik_sense | all versions | β |
| qlik/qlik_sense | all versions | β |
| qlik/qlik_sense | all versions | β |
| qlik/qlik_sense | all versions | β |
| qlik/qlik_sense | all versions | β |
| qlik/qlik_sense | all versions | β |
| qlik/qlik_sense | all versions | β |
| qlik/qlik_sense | all versions | β |
| qlik/qlik_sense | all versions | β |
| qlik/qlik_sense | all versions | β |
| qlik/qlik_sense | all versions | β |
| qlik/qlik_sense | all versions | β |
| qlik/qlik_sense | all versions | β |
| qlik/qlik_sense | all versions | β |
| qlik/qlik_sense | all versions | β |
| qlik/qlik_sense | all versions | β |
| qlik/qlik_sense | all versions | β |
| qlik/qlik_sense | all versions | β |
| qlik/qlik_sense | all versions | β |
| qlik/qlik_sense | all versions | β |
| qlik/qlik_sense | all versions | β |
| qlik/qlik_sense | all versions | β |
| qlik/qlik_sense | all versions | β |
| qlik/qlik_sense | all versions | β |
| qlik/qlik_sense | all versions | β |
| qlik/qlik_sense | all versions | β |
| qlik/qlik_sense | all versions | β |
| qlik/qlik_sense | all versions | β |
| qlik/qlik_sense | all versions | β |
| qlik/qlik_sense | all versions | β |
| qlik/qlik_sense | all versions | β |
| qlik/qlik_sense | all versions | β |
| qlik/qlik_sense | all versions | β |