CVE-2025-26495 (GCVE-0-2025-26495)

Vulnerability from cvelistv5 – Published: 2025-02-11 17:56 – Updated: 2025-03-04 20:15
VLAI?
Title
Sensitive Data Exposure in Tableau Server
Summary
Cleartext Storage of Sensitive Information vulnerability in Salesforce Tableau Server can record the Personal Access Token (PAT) into logging repositories.This issue affects Tableau Server: before 2022.1.3, before 2021.4.8, before 2021.3.13, before 2021.2.14, before 2021.1.16, before 2020.4.19.
Severity ?
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE
  • CWE-312 - Cleartext Storage of Sensitive Information
Assigner
References
Impacted products
Vendor Product Version
Salesforce Tableau Server Affected: 0 , < 2022.1.3 (custom)
Affected: 0 , < 2021.4.8 (custom)
Affected: 0 , < 2021.3.13 (custom)
Affected: 0 , < 2021.2.14 (custom)
Affected: 0 , < 2021.1.16 (custom)
Affected: 0 , < 2020.4.19 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-26495",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-04T20:15:23.243570Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-04T20:15:58.653Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Tableau Server",
          "vendor": "Salesforce",
          "versions": [
            {
              "lessThan": "2022.1.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2021.4.8",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2021.3.13",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2021.2.14",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2021.1.16",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2020.4.19",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Cleartext Storage of Sensitive Information vulnerability in Salesforce Tableau Server can record the Personal Access Token (PAT) into logging repositories.\u003cp\u003eThis issue affects Tableau Server: before 2022.1.3, before 2021.4.8, before 2021.3.13, before 2021.2.14, before 2021.1.16, before 2020.4.19.\u003c/p\u003e"
            }
          ],
          "value": "Cleartext Storage of Sensitive Information vulnerability in Salesforce Tableau Server can record the Personal Access Token (PAT) into logging repositories.This issue affects Tableau Server: before 2022.1.3, before 2021.4.8, before 2021.3.13, before 2021.2.14, before 2021.1.16, before 2020.4.19."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-21",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-21 Exploitation of Trusted Identifiers"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-312",
              "description": "CWE-312 Cleartext Storage of Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-11T17:56:38.732Z",
        "orgId": "c9b25dee-ae6d-4083-ba23-638c500cc364",
        "shortName": "Salesforce"
      },
      "references": [
        {
          "url": "https://help.salesforce.com/s/articleView?id=000390611\u0026type=1"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Sensitive Data Exposure in Tableau Server",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c9b25dee-ae6d-4083-ba23-638c500cc364",
    "assignerShortName": "Salesforce",
    "cveId": "CVE-2025-26495",
    "datePublished": "2025-02-11T17:56:38.732Z",
    "dateReserved": "2025-02-11T17:18:13.649Z",
    "dateUpdated": "2025-03-04T20:15:58.653Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-26495\",\"sourceIdentifier\":\"security@salesforce.com\",\"published\":\"2025-02-11T18:15:47.237\",\"lastModified\":\"2025-10-29T15:08:01.430\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Cleartext Storage of Sensitive Information vulnerability in Salesforce Tableau Server can record the Personal Access Token (PAT) into logging repositories.This issue affects Tableau Server: before 2022.1.3, before 2021.4.8, before 2021.3.13, before 2021.2.14, before 2021.1.16, before 2020.4.19.\"},{\"lang\":\"es\",\"value\":\"La vulnerabilidad de almacenamiento de informaci\u00f3n confidencial en texto plano en Salesforce Tableau Server puede registrar el token de acceso personal (PAT) en repositorios de registro. Este problema afecta a Tableau Server: antes de 2022.1.3, antes de 2021.4.8, antes de 2021.3.13, antes de 2021.2.14, antes de 2021.1.16, antes de 2020.4.19.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security@salesforce.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-312\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:tableau:tableau_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2020.4\",\"versionEndExcluding\":\"2020.4.19\",\"matchCriteriaId\":\"89668C62-9F48-4914-A391-4DA1CE44C7F5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:tableau:tableau_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2021.1\",\"versionEndExcluding\":\"2021.1.16\",\"matchCriteriaId\":\"A26646C2-CA36-45DE-8BDB-6D14A5190F38\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:tableau:tableau_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2021.2\",\"versionEndExcluding\":\"2021.2.14\",\"matchCriteriaId\":\"B4BEDE08-81B5-4E10-8651-69CE9DEE5086\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:tableau:tableau_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2021.3\",\"versionEndExcluding\":\"2021.3.13\",\"matchCriteriaId\":\"FD291DFE-EA74-4755-B6FB-4961F7B74065\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:tableau:tableau_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2021.4\",\"versionEndExcluding\":\"2021.4.8\",\"matchCriteriaId\":\"8DD95C14-E97C-4CD3-A29A-9049AA04478D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:tableau:tableau_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2022.1\",\"versionEndExcluding\":\"2022.1.3\",\"matchCriteriaId\":\"FE8D01C1-E585-458B-A8DD-8A0FA60FF890\"}]}]}],\"references\":[{\"url\":\"https://help.salesforce.com/s/articleView?id=000390611\u0026type=1\",\"source\":\"security@salesforce.com\",\"tags\":[\"Broken Link\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-26495\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-03-04T20:15:23.243570Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-03-04T20:14:37.952Z\"}}], \"cna\": {\"title\": \"Sensitive Data Exposure in Tableau Server\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"impacts\": [{\"capecId\": \"CAPEC-21\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-21 Exploitation of Trusted Identifiers\"}]}], \"affected\": [{\"vendor\": \"Salesforce\", \"product\": \"Tableau Server\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"2022.1.3\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"2021.4.8\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"2021.3.13\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"2021.2.14\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"2021.1.16\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"2020.4.19\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://help.salesforce.com/s/articleView?id=000390611\u0026type=1\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Cleartext Storage of Sensitive Information vulnerability in Salesforce Tableau Server can record the Personal Access Token (PAT) into logging repositories.This issue affects Tableau Server: before 2022.1.3, before 2021.4.8, before 2021.3.13, before 2021.2.14, before 2021.1.16, before 2020.4.19.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Cleartext Storage of Sensitive Information vulnerability in Salesforce Tableau Server can record the Personal Access Token (PAT) into logging repositories.\u003cp\u003eThis issue affects Tableau Server: before 2022.1.3, before 2021.4.8, before 2021.3.13, before 2021.2.14, before 2021.1.16, before 2020.4.19.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-312\", \"description\": \"CWE-312 Cleartext Storage of Sensitive Information\"}]}], \"providerMetadata\": {\"orgId\": \"c9b25dee-ae6d-4083-ba23-638c500cc364\", \"shortName\": \"Salesforce\", \"dateUpdated\": \"2025-02-11T17:56:38.732Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-26495\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-03-04T20:15:58.653Z\", \"dateReserved\": \"2025-02-11T17:18:13.649Z\", \"assignerOrgId\": \"c9b25dee-ae6d-4083-ba23-638c500cc364\", \"datePublished\": \"2025-02-11T17:56:38.732Z\", \"assignerShortName\": \"Salesforce\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.