Pierluigi Paganini December 11, 2023

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds two Qlik Sense vulnerabilities to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two Qlik Sense vulnerabilities to its .

Below is the list of the issues added to the catalog:

• (CVSS score 9.6)- Qlik Sense HTTP Tunneling Vulnerability: Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software.
• (CVSS score 8.2) – Qlik Sense Path Traversal Vulnerability: Qlik Sense contains a path traversal vulnerability that allows a remote, unauthenticated attacker to create an anonymous session by sending maliciously crafted HTTP requests. This anonymous session could allow the attacker to send further requests to unauthorized endpoints.

Researchers at cybersecurity firm Praetorian the two vulnerabilities in August 2023. The popular researcher Kevin Beaumont pointed out threat actors started exploiting a full exploit chain published by Praetorian.

Researchers from Arctic Wolf also threat actors exploiting both flaws in attacks carried out by the Cactus ransomware gang.

According to , FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts recommend also private organizations review the  and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix these vulnerabilities by December 28, 2023.

Last week the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Qualcomm vulnerabilities to its .

Follow me on Twitter:  and  and Mastodon

(SecurityAffairs – hacking, CISA)