CVE-2023-41266

Qlik Sense path traversal flaw lets unauthenticated attackers create anonymous sessions to hit unauthorized endpoints.

A remote, unauthenticated attacker can exploit a path traversal vulnerability in Qlik Sense to create anonymous sessions and access unauthorized endpoints. This is a critical, actively exploited vulnerability linked to ransomware, meaning DIB organizations using Qlik Sense face immediate exposure to data theft and ransomware attacks. Organizations must patch this vulnerability immediately and assess their Qlik Sense deployments for exposure.

Shame score — A critical, actively exploited vulnerability linked to ransomware that allows unauthenticated attackers to bypass access controls and access unauthorized endpoints.