Path Traversal in Qlik Sense (CVE‑2023‑41266) Enables Unauthenticated Session Hijacking
What It Is – Qlik Sense contains a path‑traversal flaw (CVE‑2023‑41266) that lets a remote, unauthenticated attacker craft HTTP requests to create an anonymous session. Once the session is established, the attacker can issue additional requests to endpoints that should be protected by authentication.
Exploitability – The vulnerability is exploitable over the network without credentials; a proof‑of‑concept exists. NVD assigns a CVSS v3.1 base score of 7.8 (High).
Affected Products – Qlik Sense (all supported on‑premise and cloud deployments prior to the vendor’s June 2024 patch).
Why It Matters for Trust & Control Assurance
- Highlights the need for continuous verification of authentication and authorization controls—a core control objective that maps to many frameworks (e.g., NIST CSF Identify / Protect).
- Demonstrates why defensible audit evidence of session‑management policies is essential for regulators and enterprise buyers.
- Reinforces the value of real‑time monitoring for anomalous anonymous sessions, enabling rapid detection and response.
Recommended Actions
- Apply Qlik’s security patch for CVE‑2023‑41266 immediately.
- Review and harden session‑creation logic: enforce authentication before any endpoint is reachable.
- Enable detailed logging of session initiation and enforce alerting on anonymous session activity.
- Conduct a control‑mapping exercise to confirm that your access‑control policies meet the relevant control objective.
Source: CISA KEV – CVE‑2023‑41266