Qlik Sense HTTP Tunneling Vulnerability (CVE-2023-48365)

Historical catalog analysis: CISA added this entry on January 13, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2023-48365 is an HTTP tunneling vulnerability (CWE-444) identified in Qlik Sense. This flaw allows an attacker to execute HTTP requests on the backend server hosting the software, which can lead to privilege escalation. The vulnerability has been noted as known for use in ransomware campaigns.

Exposure and applicability

This vulnerability affects organizations deploying Qlik Sense. The primary exposure path involves the ability of an attacker to tunnel HTTP traffic to reach backend services that should otherwise be isolated or restricted. Because this flaw enables privilege escalation, it increases the risk that an initial foothold on the system could be leveraged to gain higher-level administrative access to the host server.

Remediation priorities

Based on our analysis of the reported vulnerability and its association with ransomware, we prioritize the following actions for infrastructure owners:

1. Immediate Mitigation Deployment: Prioritize the application of security fixes as specified in vendor instructions. This is the primary method to reduce the likelihood of initial exploitation via HTTP tunneling.
2. Asset Identification: Identify all instances of Qlik Sense across the environment to ensure no unpatched or unmitigated servers remain exposed.
3. Access Review: Evaluate backend server access controls to determine if current network segmentation could limit the impact of unauthorized HTTP requests, though this does not resolve the underlying vulnerability.
4. Decommissioning Evaluation: In scenarios where vendor mitigations cannot be applied or are unavailable, evaluate the necessity of the product versus the risk of continued exposure, including the option to discontinue use.

How to validate remediation

Verification must move beyond simple version checks, as a deployed patch does not inherently guarantee that the vulnerability is mitigated in a specific environment. We recommend the following validation approach:

• Configuration Audit: Verify that the specific security fixes recommended by the vendor are active and correctly configured on the backend server.
• Connectivity Testing: Use authorized network testing tools to verify whether HTTP tunneling paths to the backend server remain open or have been successfully closed/restricted according to the mitigation guidelines.
• Privilege Verification: Confirm that the privilege escalation path is no longer viable by attempting to execute unauthorized backend requests using a low-privileged account in a controlled, authorized test environment.

Limits and open questions

Applying vendor mitigations could reduce the likelihood of exploitation, but residual risk remains if other vulnerabilities exist within the same tunneling path or if misconfigurations occur during the update process. It remains unclear from the available data exactly which versions are affected or the specific technical requirements for a successful tunnel; defenders should rely on official vendor documentation for precise versioning and patch levels.

Source and editorial note

CVE-2023-48365: Qlik Sense HTTP Tunneling Vulnerability · Source date: January 13, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: January 16, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 28, 2026 at 00:41 UTC.

Request a Vulnerability Assessment