Vulnerabilites related to tableau - tableau_desktop
cve-2019-15637
Vulnerability from cvelistv5
Published
2019-08-26 16:21
Modified
2024-08-05 00:56
Severity ?
EPSS score ?
Summary
Numerous Tableau products are vulnerable to XXE via a malicious workbook, extension, or data source, leading to information disclosure or a DoS. This affects Tableau Server, Tableau Desktop, Tableau Reader, and Tableau Public Desktop.
References
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-05T00:56:22.155Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://community.tableau.com/community/security-bulletins/blog/2019/08/22/important-adv-2019-030-xxe-vulnerability-in-tableau-products", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://github.com/minecrater/exploits/blob/master/TableauXXE.py", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://packetstormsecurity.com/files/154232/Tableau-XML-Injection.html", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "n/a", vendor: "n/a", versions: [ { status: "affected", version: "n/a", }, ], }, ], descriptions: [ { lang: "en", value: "Numerous Tableau products are vulnerable to XXE via a malicious workbook, extension, or data source, leading to information disclosure or a DoS. This affects Tableau Server, Tableau Desktop, Tableau Reader, and Tableau Public Desktop.", }, ], metrics: [ { cvssV3_0: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "LOW", baseScore: 7.1, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AC:L/AV:N/A:L/C:H/I:N/PR:L/S:U/UI:N", version: "3.0", }, }, ], problemTypes: [ { descriptions: [ { description: "n/a", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2019-08-27T16:55:59", orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", shortName: "mitre", }, references: [ { tags: [ "x_refsource_MISC", ], url: "https://community.tableau.com/community/security-bulletins/blog/2019/08/22/important-adv-2019-030-xxe-vulnerability-in-tableau-products", }, { tags: [ "x_refsource_MISC", ], url: "https://github.com/minecrater/exploits/blob/master/TableauXXE.py", }, { tags: [ "x_refsource_MISC", ], url: "https://packetstormsecurity.com/files/154232/Tableau-XML-Injection.html", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "cve@mitre.org", ID: "CVE-2019-15637", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "n/a", version: { version_data: [ { version_value: "n/a", }, ], }, }, ], }, vendor_name: "n/a", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Numerous Tableau products are vulnerable to XXE via a malicious workbook, extension, or data source, leading to information disclosure or a DoS. This affects Tableau Server, Tableau Desktop, Tableau Reader, and Tableau Public Desktop.", }, ], }, impact: { cvss: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "LOW", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AC:L/AV:N/A:L/C:H/I:N/PR:L/S:U/UI:N", version: "3.0", }, }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "n/a", }, ], }, ], }, references: { reference_data: [ { name: "https://community.tableau.com/community/security-bulletins/blog/2019/08/22/important-adv-2019-030-xxe-vulnerability-in-tableau-products", refsource: "MISC", url: "https://community.tableau.com/community/security-bulletins/blog/2019/08/22/important-adv-2019-030-xxe-vulnerability-in-tableau-products", }, { name: "https://github.com/minecrater/exploits/blob/master/TableauXXE.py", refsource: "MISC", url: "https://github.com/minecrater/exploits/blob/master/TableauXXE.py", }, { name: "https://packetstormsecurity.com/files/154232/Tableau-XML-Injection.html", refsource: "MISC", url: "https://packetstormsecurity.com/files/154232/Tableau-XML-Injection.html", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", assignerShortName: "mitre", cveId: "CVE-2019-15637", datePublished: "2019-08-26T16:21:07", dateReserved: "2019-08-26T00:00:00", dateUpdated: "2024-08-05T00:56:22.155Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
Vulnerability from fkie_nvd
Published
2019-08-26 17:15
Modified
2024-11-21 04:29
Severity ?
Summary
Numerous Tableau products are vulnerable to XXE via a malicious workbook, extension, or data source, leading to information disclosure or a DoS. This affects Tableau Server, Tableau Desktop, Tableau Reader, and Tableau Public Desktop.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://community.tableau.com/community/security-bulletins/blog/2019/08/22/important-adv-2019-030-xxe-vulnerability-in-tableau-products | Vendor Advisory | |
| cve@mitre.org | https://github.com/minecrater/exploits/blob/master/TableauXXE.py | Exploit, Third Party Advisory | |
| cve@mitre.org | https://packetstormsecurity.com/files/154232/Tableau-XML-Injection.html | Exploit, Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://community.tableau.com/community/security-bulletins/blog/2019/08/22/important-adv-2019-030-xxe-vulnerability-in-tableau-products | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/minecrater/exploits/blob/master/TableauXXE.py | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://packetstormsecurity.com/files/154232/Tableau-XML-Injection.html | Exploit, Third Party Advisory, VDB Entry |
Impacted products
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:tableau:tableau_server:*:*:*:*:*:*:*:*", matchCriteriaId: "7E95A215-C68A-4E39-AF1B-6D7427E56973", versionEndIncluding: "10.5.18", versionStartIncluding: "10.5", vulnerable: true, }, { criteria: "cpe:2.3:a:tableau:tableau_server:*:*:*:*:*:*:*:*", matchCriteriaId: "E385CA2A-E91A-4BC7-8506-BEF6062B150C", versionEndIncluding: "2018.1.15", versionStartIncluding: "2018.1", vulnerable: true, }, { criteria: "cpe:2.3:a:tableau:tableau_server:*:*:*:*:*:*:*:*", matchCriteriaId: "BE1A7008-8A45-401D-834B-0BB2C1EA0C33", versionEndIncluding: "2018.12", versionStartIncluding: "2018.2", vulnerable: true, }, { criteria: "cpe:2.3:a:tableau:tableau_server:*:*:*:*:*:*:*:*", matchCriteriaId: "947A754A-05EF-40F0-8AA8-30F1A14BC4D9", versionEndIncluding: "2018.3.9", versionStartIncluding: "2018.3", vulnerable: true, }, { criteria: "cpe:2.3:a:tableau:tableau_server:*:*:*:*:*:*:*:*", matchCriteriaId: "4929F7F1-F93C-4B8C-82E1-5BFE1151E9B9", versionEndIncluding: "2019.1.6", versionStartIncluding: "2019.1", vulnerable: true, }, { criteria: "cpe:2.3:a:tableau:tableau_server:*:*:*:*:*:*:*:*", matchCriteriaId: "EE7C9914-27BB-4A77-925C-F33C7F5442A7", versionEndIncluding: "2019.2.2", versionStartIncluding: "2019.2", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", matchCriteriaId: "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:tableau:tableau_server:*:*:*:*:*:*:*:*", matchCriteriaId: "9251CC38-30D8-430E-8686-65E5087DA8A3", versionEndIncluding: "10.2.23", versionStartIncluding: "10.2", vulnerable: true, }, { criteria: "cpe:2.3:a:tableau:tableau_server:*:*:*:*:*:*:*:*", matchCriteriaId: "024F8EBE-56EB-4823-9C9D-0235F6B8364D", versionEndIncluding: "10.3.23", versionStartIncluding: "10.3", vulnerable: true, }, { criteria: "cpe:2.3:a:tableau:tableau_server:*:*:*:*:*:*:*:*", matchCriteriaId: "8E8BF98F-59E5-4AEF-9C66-5D0232A77E04", versionEndIncluding: "10.4.19", versionStartIncluding: "10.4", vulnerable: true, }, { criteria: "cpe:2.3:a:tableau:tableau_server:*:*:*:*:*:*:*:*", matchCriteriaId: "7E95A215-C68A-4E39-AF1B-6D7427E56973", versionEndIncluding: "10.5.18", versionStartIncluding: "10.5", vulnerable: true, }, { criteria: "cpe:2.3:a:tableau:tableau_server:*:*:*:*:*:*:*:*", matchCriteriaId: "E385CA2A-E91A-4BC7-8506-BEF6062B150C", versionEndIncluding: "2018.1.15", versionStartIncluding: "2018.1", vulnerable: true, }, { criteria: "cpe:2.3:a:tableau:tableau_server:*:*:*:*:*:*:*:*", matchCriteriaId: "BE1A7008-8A45-401D-834B-0BB2C1EA0C33", versionEndIncluding: "2018.12", versionStartIncluding: "2018.2", vulnerable: true, }, { criteria: "cpe:2.3:a:tableau:tableau_server:*:*:*:*:*:*:*:*", matchCriteriaId: "947A754A-05EF-40F0-8AA8-30F1A14BC4D9", versionEndIncluding: "2018.3.9", versionStartIncluding: "2018.3", vulnerable: true, }, { criteria: "cpe:2.3:a:tableau:tableau_server:*:*:*:*:*:*:*:*", matchCriteriaId: "4929F7F1-F93C-4B8C-82E1-5BFE1151E9B9", versionEndIncluding: "2019.1.6", versionStartIncluding: "2019.1", vulnerable: true, }, { criteria: "cpe:2.3:a:tableau:tableau_server:*:*:*:*:*:*:*:*", matchCriteriaId: "EE7C9914-27BB-4A77-925C-F33C7F5442A7", versionEndIncluding: "2019.2.2", versionStartIncluding: "2019.2", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", matchCriteriaId: "A2572D17-1DE6-457B-99CC-64AFD54487EA", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:tableau:tableau_desktop:*:*:*:*:*:*:*:*", matchCriteriaId: "0B8F1A52-AA3D-4D12-A518-0721FAD63102", versionEndIncluding: "10.2.23", versionStartIncluding: "10.2", vulnerable: true, }, { criteria: "cpe:2.3:a:tableau:tableau_desktop:*:*:*:*:*:*:*:*", matchCriteriaId: "E057777C-880F-4E22-B4FB-CB2341E83610", versionEndIncluding: "10.3.23", versionStartIncluding: "10.3", vulnerable: true, }, { criteria: "cpe:2.3:a:tableau:tableau_desktop:*:*:*:*:*:*:*:*", matchCriteriaId: "541F2AF1-AB8A-412D-94B6-CE481DCCA332", versionEndIncluding: "10.4.19", versionStartIncluding: "10.4", vulnerable: true, }, { criteria: "cpe:2.3:a:tableau:tableau_desktop:*:*:*:*:*:*:*:*", matchCriteriaId: "DF1B0077-F84B-4900-9215-F68DED52CE07", versionEndIncluding: "10.5.18", versionStartIncluding: "10.5", vulnerable: true, }, { criteria: "cpe:2.3:a:tableau:tableau_desktop:*:*:*:*:*:*:*:*", matchCriteriaId: "BBDFBAF8-CE09-4415-A03D-455AA5883F02", versionEndIncluding: "2018.1.15", versionStartIncluding: "2018.1", vulnerable: true, }, { criteria: "cpe:2.3:a:tableau:tableau_desktop:*:*:*:*:*:*:*:*", matchCriteriaId: "20A4CDDF-58A1-49E7-94E7-F59F84894C61", versionEndIncluding: "2018.2.12", versionStartIncluding: "2018.2", vulnerable: true, }, { criteria: "cpe:2.3:a:tableau:tableau_desktop:*:*:*:*:*:*:*:*", matchCriteriaId: "AAEF5EF7-F5DA-4A60-A7E3-313F7D1C5DA2", versionEndIncluding: "2018.3.9", versionStartIncluding: "2018.3", vulnerable: true, }, { criteria: "cpe:2.3:a:tableau:tableau_desktop:*:*:*:*:*:*:*:*", matchCriteriaId: "46C3C48B-2CBA-455E-9B8F-036395813507", versionEndIncluding: "2019.1.6", versionStartIncluding: "2019.1", vulnerable: true, }, { criteria: "cpe:2.3:a:tableau:tableau_desktop:*:*:*:*:*:*:*:*", matchCriteriaId: "4FEA910B-FA61-414E-82DC-6FACC4693649", versionEndIncluding: "2019.2.2", versionStartIncluding: "2019.2", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", matchCriteriaId: "387021A0-AF36-463C-A605-32EA7DAC172E", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:tableau:tableau_desktop:*:*:*:*:*:*:*:*", matchCriteriaId: "0B8F1A52-AA3D-4D12-A518-0721FAD63102", versionEndIncluding: "10.2.23", versionStartIncluding: "10.2", vulnerable: true, }, { criteria: "cpe:2.3:a:tableau:tableau_desktop:*:*:*:*:*:*:*:*", matchCriteriaId: "E057777C-880F-4E22-B4FB-CB2341E83610", versionEndIncluding: "10.3.23", versionStartIncluding: "10.3", vulnerable: true, }, { criteria: "cpe:2.3:a:tableau:tableau_desktop:*:*:*:*:*:*:*:*", matchCriteriaId: "541F2AF1-AB8A-412D-94B6-CE481DCCA332", versionEndIncluding: "10.4.19", versionStartIncluding: "10.4", vulnerable: true, }, { criteria: "cpe:2.3:a:tableau:tableau_desktop:*:*:*:*:*:*:*:*", matchCriteriaId: "DF1B0077-F84B-4900-9215-F68DED52CE07", versionEndIncluding: "10.5.18", versionStartIncluding: "10.5", vulnerable: true, }, { criteria: "cpe:2.3:a:tableau:tableau_desktop:*:*:*:*:*:*:*:*", matchCriteriaId: "BBDFBAF8-CE09-4415-A03D-455AA5883F02", versionEndIncluding: "2018.1.15", versionStartIncluding: "2018.1", vulnerable: true, }, { criteria: "cpe:2.3:a:tableau:tableau_desktop:*:*:*:*:*:*:*:*", matchCriteriaId: "20A4CDDF-58A1-49E7-94E7-F59F84894C61", versionEndIncluding: "2018.2.12", versionStartIncluding: "2018.2", vulnerable: true, }, { criteria: "cpe:2.3:a:tableau:tableau_desktop:*:*:*:*:*:*:*:*", matchCriteriaId: "AAEF5EF7-F5DA-4A60-A7E3-313F7D1C5DA2", versionEndIncluding: "2018.3.9", versionStartIncluding: "2018.3", vulnerable: true, }, { criteria: "cpe:2.3:a:tableau:tableau_desktop:*:*:*:*:*:*:*:*", matchCriteriaId: "46C3C48B-2CBA-455E-9B8F-036395813507", versionEndIncluding: "2019.1.6", versionStartIncluding: "2019.1", vulnerable: true, }, { criteria: "cpe:2.3:a:tableau:tableau_desktop:*:*:*:*:*:*:*:*", matchCriteriaId: "4FEA910B-FA61-414E-82DC-6FACC4693649", versionEndIncluding: "2019.2.2", versionStartIncluding: "2019.2", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", matchCriteriaId: "A2572D17-1DE6-457B-99CC-64AFD54487EA", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:tableau:tableau_reader:*:*:*:*:*:*:*:*", matchCriteriaId: "95670BED-5773-45AB-AAB8-6338874A690A", versionEndIncluding: "10.2.2", versionStartIncluding: "10.2", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", matchCriteriaId: "387021A0-AF36-463C-A605-32EA7DAC172E", vulnerable: false, }, { criteria: "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", matchCriteriaId: "A2572D17-1DE6-457B-99CC-64AFD54487EA", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:tableau:tableau_public_desktop:*:*:*:*:*:*:*:*", matchCriteriaId: "C2C45810-5A87-4FE4-8857-E14F8ACE659E", versionEndIncluding: "10.2.2", versionStartIncluding: "10.2", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", matchCriteriaId: "387021A0-AF36-463C-A605-32EA7DAC172E", vulnerable: false, }, { criteria: "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", matchCriteriaId: "A2572D17-1DE6-457B-99CC-64AFD54487EA", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, ], cveTags: [], descriptions: [ { lang: "en", value: "Numerous Tableau products are vulnerable to XXE via a malicious workbook, extension, or data source, leading to information disclosure or a DoS. This affects Tableau Server, Tableau Desktop, Tableau Reader, and Tableau Public Desktop.", }, { lang: "es", value: "Numerosos productos de Tableau son vulnerables a ataque de tipo XXE por medio de un libro de trabajo, extensión o fuente de datos maliciosos, lo que conlleva a la divulgación de información o a una DoS. Esto afecta a Tableau Server, Tableau Desktop, Tableau Reader y Tableau Public Desktop.", }, ], id: "CVE-2019-15637", lastModified: "2024-11-21T04:29:10.270", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "SINGLE", availabilityImpact: "PARTIAL", baseScore: 5.5, confidentialityImpact: "PARTIAL", integrityImpact: "NONE", vectorString: "AV:N/AC:L/Au:S/C:P/I:N/A:P", version: "2.0", }, exploitabilityScore: 8, impactScore: 4.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], cvssMetricV30: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "LOW", baseScore: 7.1, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L", version: "3.0", }, exploitabilityScore: 2.8, impactScore: 4.2, source: "cve@mitre.org", type: "Secondary", }, ], cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.1, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", version: "3.1", }, exploitabilityScore: 2.8, impactScore: 5.2, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2019-08-26T17:15:12.710", references: [ { source: "cve@mitre.org", tags: [ "Vendor Advisory", ], url: "https://community.tableau.com/community/security-bulletins/blog/2019/08/22/important-adv-2019-030-xxe-vulnerability-in-tableau-products", }, { source: "cve@mitre.org", tags: [ "Exploit", "Third Party Advisory", ], url: "https://github.com/minecrater/exploits/blob/master/TableauXXE.py", }, { source: "cve@mitre.org", tags: [ "Exploit", "Third Party Advisory", "VDB Entry", ], url: "https://packetstormsecurity.com/files/154232/Tableau-XML-Injection.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://community.tableau.com/community/security-bulletins/blog/2019/08/22/important-adv-2019-030-xxe-vulnerability-in-tableau-products", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Exploit", "Third Party Advisory", ], url: "https://github.com/minecrater/exploits/blob/master/TableauXXE.py", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Exploit", "Third Party Advisory", "VDB Entry", ], url: "https://packetstormsecurity.com/files/154232/Tableau-XML-Injection.html", }, ], sourceIdentifier: "cve@mitre.org", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-611", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }