PT-2019-14310 · Tableau · Tableau Desktop+3

Published 2019-08-26 · Updated 2022-04-18 · CVE-2019-15637

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Tableau Server (affected versions not specified) Tableau Desktop (affected versions not specified) Tableau Reader (affected versions not specified) Tableau Public Desktop (affected versions not specified)

Description The issue allows for XXE (XML External Entity) attacks via malicious workbooks, extensions, or data sources. This can result in information disclosure or a denial of service (DoS).

Recommendations For Tableau Server, update to a version that includes a fix for this issue. For Tableau Desktop, update to a version that includes a fix for this issue. For Tableau Reader, update to a version that includes a fix for this issue. For Tableau Public Desktop, update to a version that includes a fix for this issue. As a temporary workaround, consider restricting the use of external workbooks, extensions, or data sources until a patch is available.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2019-15637

Affected Products

Tableau Desktop

Tableau Public Desktop

Tableau Reader

Tableau Server

References · 6

• 🔥 https://github.com/minecrater/exploits/blob/master/TableauXXE.py · Exploit
• 🔥 https://exploit-db.com/exploits/47308 · Exploit
• 🔥 https://packetstormsecurity.com/files/154232/Tableau-XML-Injection.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-15637 · Security Note
• https://community.tableau.com/community/security-bulletins/blog/2019/08/22/important-adv-2019-030-xxe-vulnerability-in-tableau-products · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-15637 · Vendor Advisory