PT-2019-14310 · Tableau · Tableau Desktop+3

Publicado 2019-08-26 · Atualizado 2022-04-18 · CVE-2019-15637

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Tableau Server (affected versions not specified) Tableau Desktop (affected versions not specified) Tableau Reader (affected versions not specified) Tableau Public Desktop (affected versions not specified)

Description The issue allows for XXE (XML External Entity) attacks via malicious workbooks, extensions, or data sources. This can result in information disclosure or a denial of service (DoS).

Recommendations For Tableau Server, update to a version that includes a fix for this issue. For Tableau Desktop, update to a version that includes a fix for this issue. For Tableau Reader, update to a version that includes a fix for this issue. For Tableau Public Desktop, update to a version that includes a fix for this issue. As a temporary workaround, consider restricting the use of external workbooks, extensions, or data sources until a patch is available.

Exploit

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2019-15637

Produtos afetados

Tableau Desktop

Tableau Public Desktop

Tableau Reader

Tableau Server

Referências · 6

• 🔥 https://github.com/minecrater/exploits/blob/master/TableauXXE.py · Exploit
• 🔥 https://exploit-db.com/exploits/47308 · Exploit
• 🔥 https://packetstormsecurity.com/files/154232/Tableau-XML-Injection.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-15637 · Nota de Segurança
• https://community.tableau.com/community/security-bulletins/blog/2019/08/22/important-adv-2019-030-xxe-vulnerability-in-tableau-products · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-15637 · Aviso do Fabricante