CVE-2023-48365

CVE Published	2023-11-15
Related CWE(s)	CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Related Vendor(s)	qlik
Related Product(s)	qlik_sense
CVSS 3 Base Score	9.6 (CRITICAL)
CVSS 3 Attack Complexity	LOW
CVSS 3 Attack Vector	NETWORK

Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attacker is able to elevate their privilege by tunneling HTTP requests, allowing them to execute HTTP requests on the backend server that hosts the repository application. The fixed versions are August 2023 Patch 2, May 2023 Patch 6, February 2023 Patch 10, November 2022 Patch 12, August 2022 Patch 14, May 2022 Patch 16, February 2022 Patch 15, and November 2021 Patch 17. NOTE: this issue exists because of an incomplete fix for CVE-2023-41265.

Cyber Threat Graph Context

Explore how this CVE relates to the wider threat graph

Threat Reports Related to CVE-2023-48365

Report

Magnet Goblin Targets Publicly Facing Servers Using 1-Day Vulnerabilities - Check Point Research

This blog post from CheckPoint Research describes a campaign targeting Ivanti, Magento, Qlink Sense and possibly Apache ActiveMQ systems which ...

View Source

Associated CAPEC Patterns

HTTP Request Smuggling (CAPEC-33)

An adversary abuses the flexibility and discrepancies in the parsing and interpretation of HTTP Request messages using various HTTP headers, request-line and body parameters as well as message sizes (denoted by the end of message signaled by a given HTTP header) by different intermediary HTTP agents (e.g., load balancer, reverse proxy, web caching proxies, application firewalls, etc.) to secretly send unauthorized and malicious HTTP requests to a back-end HTTP agent (e.g., web server). See CanPrecede relationships for possible consequences.

HTTP Response Smuggling (CAPEC-273)

An adversary manipulates and injects malicious content in the form of secret unauthorized HTTP responses, into a single HTTP response from a vulnerable or compromised back-end HTTP agent (e.g., server). See CanPrecede relationships for possible consequences.

References

CVE.org

View more information about CVE-2023-48365 on the official MITRE CVE website.

NIST National Vulnerability Database

CVE-2023-48365 on the NIST NVD.