PT-2025-30926 · Tableau · Tableau Server

Published 2025-06-26 · Updated 2025-10-31 · CVE-2025-52453

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Tableau Server versions prior to 2025.1.3 Tableau Server versions prior to 2024.2.12 Tableau Server versions prior to 2023.3.19

Description The issue is a Server-Side Request Forgery (SSRF) in the Flow Data Source modules of Tableau Server on Windows and Linux. Successful exploitation allows an attacker to perform Resource Location Spoofing. SSRF occurs when a server-side application fetches a remote resource without validating the provided URL. This can allow an attacker to cause the server to make requests to unintended locations, potentially exposing sensitive data or performing actions on behalf of the server.

Recommendations Tableau Server versions prior to 2025.1.3 should be updated. Tableau Server versions prior to 2024.2.12 should be updated. Tableau Server versions prior to 2023.3.19 should be updated.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2025-09769

CVE-2025-52453

Affected Products

Tableau Server

References · 10

• https://bdu.fstec.ru/vul/2025-09769 · Security Note
• https://help.salesforce.com/s/articleView?id=005105043&type=1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-52453 · Security Note
• https://osv.dev/vulnerability/CVE-2025-52453 · Vendor Advisory
• https://t.me/cveNotify/141171 · Telegram Post
• https://webasha.com/blog/what-are-the-critical-vulnerabilities-in-salesforce-tableau-server-and-how-can-they-be-exploited-by-attackers · Note
• https://twitter.com/CVEnew/status/1948859491325555124 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1948846470766944603 · Twitter Post
• https://twitter.com/cracbot/status/1950511787431932271 · Twitter Post
• https://cvefind.com/en/cve/CVE-2025-52453.html · Note