PT-2022-15263 · Tableau · Tableau Server

Published 2022-05-25 · Updated 2023-08-08 · CVE-2022-22127

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tableau Server versions 2020.4.16 through 2021.4.4 and earlier

Description A broken access control issue is present in Tableau Server, affecting customers who use Local Identity Store for user management. This issue allows a malicious site administrator to change passwords for users in different sites hosted on the same Tableau Server, potentially leading to unauthorized access to data.

Recommendations For Tableau Server versions 2020.4.16 through 2021.4.4 and earlier, update to a future release of Tableau Server, as all future releases will address this security issue. As a temporary workaround, consider restricting the privileges of site administrators to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2022-22127

Affected Products

Tableau Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-22127 · Security Note
• https://osv.dev/vulnerability/CVE-2022-22127 · Vendor Advisory
• https://help.salesforce.com/s/articleView?id=000365493&type=1 · Note
• https://t.me/cibsecurity/43341 · Telegram Post
• https://t.me/cvenotify/30705 · Telegram Post