CVE-2023-48365 is a HTTP tunneling vulnerability in Qlik Sense. CISA added it to the Known Exploited Vulnerabilities catalogue on 13 January 2025, which means attackers have used it in real attacks. Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software.
What HTTP tunneling means in a security context
HTTP tunneling vulnerabilities matter because they let an attacker abuse a web-facing request path as a covert channel into backend functions. In products like Qlik Sense, that can turn a normally mediated interface into a route for privileged server-side actions.
The key security issue is not the HTTP protocol itself, but the trust boundary it crosses. When tunneling is accepted without strict validation, an external requester may be able to reach internal handlers, metadata, or administrative functions that were never meant to be directly exposed.
Why this kind of flaw is dangerous in enterprise software
Privilege escalation is a serious consequence because the attacker can move from a lower-trust entry point to a higher-trust backend context. Once that happens, the impact can extend beyond the original application request and affect the host that runs the software.
In practice, these flaws often become more valuable when the exposed service is internet-facing, widely deployed, or used as a gateway into sensitive business workflows. The presence of real-world exploitation is why CISA KEV inclusion should be treated as an operational priority, not just a catalogue entry.
For authoritative version and patch details, readers should consult the CVE Program record and the NIST National Vulnerability Database entry rather than relying on summaries alone.
How organisations assess exposure and limit blast radius
Exposure review starts with asset inventory, because teams need to know where Qlik Sense is deployed, which instances are internet-reachable, and whether any instance is still in a vulnerable operational state. Vendor advisories and exposure checks should be paired, since local configuration and deployment patterns can change the risk picture.
Where patching is delayed, defenders should reduce reachability and privilege at the edge. That usually means tightening network access, restricting administrative paths, and removing unnecessary exposure to backend services that could be reached through the vulnerable tunneling path.
A structured vulnerability process helps here. NHIMG’s Vulnerability Management Guide is useful for prioritising confirmed KEV items, validating remediation, and tracking exceptions until the exposure is closed.
Detection, compromise review, and identity impact
Detection should look for suspicious backend request patterns, unusual administrative activity, and signs that the application was used as a pivot point rather than as a normal user-facing service. If exploitation is suspected, the investigation should not stop at the CVE itself, because the real question is whether the backend host or adjacent services were touched.
Post-patch review is especially important when the flaw may have enabled privilege escalation. If attackers gained backend execution or administrative reach, organisations should consider whether service credentials, sessions, certificates, or other secret material were observed or abused during the compromise.
That is why patterns of credential exposure and privilege abuse deserve close attention. NHIMG’s Ivanti Connect Secure exploitation 2024 and CitrixBleed exploitation 2023 show why session material and backend credentials often need review after an edge or tunneling flaw is abused.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.AM-01 — Identities and Assets | Qlik Sense exposure depends on knowing where the vulnerable service is deployed. |
| PR.AA-01 — Identities and Access Credentials are Issued, Managed, Verifiable, Revoked, and Auditable | Privilege escalation and backend access make credential governance directly relevant. | |
| DE.CM-01 — Networks and Network Services are Monitored to Find Potentially Adverse Events | Detection of tunneling abuse depends on monitoring anomalous network and service activity. | |
| Recommendation — Inventory every Qlik Sense instance and map where the vulnerable service is exposed. Review and revoke any credentials or sessions that may have been used through the affected path. Monitor for unusual tunneling, backend request, and administrative access patterns. | ||
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Privilege escalation paths often hinge on compromised authenticated access. |
| Recommendation — Reassess authentication strength for any administrative access to the affected platform. | ||
Practitioner Guidance
Why practitioners should care: Treat this CVE as a compromise-enabling weakness, not just a service bug. If a tunneling flaw can reach backend server functions, the security question becomes whether that path can be used to gain higher privilege or access adjacent systems.
What to watch for: Prioritise instances that are internet-facing, heavily integrated, or used for administrative access, because those deployments increase the chance that exploitation will have operational consequences beyond the application itself. If compromise is plausible, broaden the review to include nearby accounts, secrets, and trust relationships.
Practitioner takeaway: The safest response is to verify exposure, apply the vendor fix as soon as possible, and assume that exploitation may have extended into backend or identity material until review proves otherwise.
Related resources from NHI Mgmt Group
- How should teams respond when Apache HTTP Server has a remote code execution CVE?
- Why do Apache HTTP Server vulnerabilities create broader risk than the CVE alone suggests?
- What is the difference between HTTP/3 and TCP tunneling for secure access?
- What should teams do first when MOVEit Transfer is exposed to CVE-2023-34362?