QID 375433

Date Published: 2021-04-15

QID 375433: Tableau Server Multiple Vulnerabilities (ADV-2021-010,ADV-2021-011,ADV-2021-012)

Tableau Server is a Business Intelligence application that allows its users to organize, edit, share, and collaborate on Tableau dashboards.

Tableau Server fails to validate certain URLs that are embedded in emails sent to Tableau Server users.

Background image edit command cause vizql server process to crash within Tableau Server.

HTML characters are not properly encoded in emails sent to users for data driven alerts.

Affected Versions:
Tableau Server on Linux 2018.2 through 2018.2.29
Tableau Server on Linux 2018.3 through 2018.3.28
Tableau Server on Linux 2019.1 through 2019.1.26
Tableau Server on Linux 2019.2 through 2019.2.22
Tableau Server on Linux 2019.3 through 2019.3.18
Tableau Server on Linux 2019.4 through 2019.4.17
Tableau Server on Linux 2020.1 through 2020.1.14
Tableau Server on Linux 2020.2 through 2020.2.11
Tableau Server on Linux 2020.3 through 2020.3.6
Tableau Server on Linux 2020.4 through 2020.4.2

Tableau Server on Windows 2018.2 through 2018.2.29
Tableau Server on Windows 2018.3 through 2018.3.28
Tableau Server on Windows 2019.1 through 2019.1.26
Tableau Server on Windows 2019.2 through 2019.2.22
Tableau Server on Windows 2019.3 through 2019.3.18
Tableau Server on Windows 2019.4 through 2019.4.17
Tableau Server on Windows 2020.1 through 2020.1.14
Tableau Server on Windows 2020.2 through 2020.2.11
Tableau Server on Windows 2020.3 through 2020.3.6
Tableau Server on Windows 2020.4 through 2020.4.2

QID Detection Logic (Authenticated)
This QID checks for the file version of tabsvc.exe for Tableau Server

An authenticated user can force Tableau Server to send emails to other Tableau Server users with an arbitrary URL

An authenticated attacker with low privileges can send crafted message to Tableau Server that makes Tableau Server unresponsive for an extended period of time.

A Tableau user can craft phishing emails to other Tableau Server users.

CVSS V3 rated as High - 6.1 severity.

CVSS V2 rated as Medium - 5.8 severity.

Solution

Customers are advised to refer to ADV-2021-010 ADV-2021-011 ADV-2021-012for information pertaining to remediating this vulnerability.

Vendor References

ADV-2021-010 - help.salesforce.com/articleView?id=000357424&type=1&mode=1
ADV-2021-011 - help.salesforce.com/articleView?id=000357453&type=1&mode=1
ADV-2021-012 - help.salesforce.com/articleView?id=000357454&type=1&mode=1

CVEs related to QID 375433

CVE-2021-1629 |

Software Advisories

Advisory ID	Software	Component	Link
ADV-2021-010			help.salesforce.com/articleView?id=000357424&type=1&mode=1
ADV-2021-011			help.salesforce.com/articleView?id=000357453&type=1&mode=1
ADV-2021-012			help.salesforce.com/articleView?id=000357454&type=1&mode=1

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].