Qlik Sense HTTP Tunneling Vulnerability
n/a — n/a
Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attacker is able to elevate their privilege by tunneling HTTP requests, allowing them to execute HTTP requests on the backend server that hosts the repository application. The fixed versions are August 2023 Patch 2, May 2023 Patch 6, February 2023 Patch 10, November 2022 Patch 12, August 2022 Patch 14, May 2022 Patch 16, February 2022 Patch 15, and November 2021 Patch 17. NOTE: this issue exists because of an incomplete fix for CVE-2023-41265.
9.6
24.7%
Vector breakdown
- Attack complexity
- Low
- Attack vector
- Network
- Availability
- None
- Confidentiality
- High
- Integrity
- High
- Privileges required
- Low
- Scope
- Changed
- User interaction
- None
CVSS:3.1/AC:L/AV:N/A:N/C:H/I:H/PR:L/S:C/UI:N
- Published
- Nov 15, 2023
- Modified
- Oct 21, 2025
- Added to KEV
- Jan 13, 2025
- Federal patch due
- Feb 3, 2025
CISA required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Weakness classification
Proof-of-concept & exploitation references
Weaponization
Public repositories whose name or description references CVE-2023-48365, found via a live GitHub search at request time. These are community-sourced signals, not a verified working exploit — cross-check each one before relying on it, and treat higher star counts and recent activity as (weak) corroboration, not proof.
No public GitHub repositories referencing CVE-2023-48365 were found at last check. Absence here is not proof no exploit exists — see the references below for vendor advisories and write-ups.
References
Frequently asked questions
What is CVE-2023-48365?
Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attacker is able to elevate their privilege by tunneling HTTP requests, allowing them to execute HTTP requests on the backend server that hosts the repository application. The fixed versions are August 2023 Patch 2, May 2023 Patch 6, February 2023 Patch 10, November 2022 Patch 12, August 2022 Patch 14, May 2022 Patch 16, February 2022 Patch 15, and November 2021 Patch 17. NOTE: this issue exists because of an incomplete fix for CVE-2023-41265.
How severe is CVE-2023-48365?
CVE-2023-48365 has a CVSS base score of 9.6 out of 10 (CVSS 3.1).
Is CVE-2023-48365 actively exploited in the wild?
Yes. CVE-2023-48365 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added Jan 13, 2025, meaning CISA has confirmed evidence of active exploitation. It is also flagged as used in ransomware campaigns.
What is the EPSS score for CVE-2023-48365?
24.7% - meaning FIRST.org's EPSS model estimates a 24.7% probability this vulnerability will be exploited in the wild within 30 days (98% percentile among all scored CVEs).
What type of vulnerability is CVE-2023-48365?
CVE-2023-48365 is classified under CWE-444 (CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')).
Cross-checked against
Impactr finds and proves whether CVE-2023-48365 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.