Skip navigation
1 2 Previous Next

Security Bulletins

22 Posts authored by: Joseph Salowey Employee

Highest overall severity: Medium


Summary:

Workbooks that use user functions inside a join calculation may not properly filter data the first time a view is loaded.


Impact:

A user with access to a published workbook can see unfiltered data for another user in the same workbook. A malicious user cannot exploit this vulnerability.


Products and Versions: Tableau Server | Tableau Desktop | Tableau Bridge | Tableau Prep Builder | Tableau Reader | Tableau Mobile | Tableau Public Desktop
Versions that are no longer supported are not tested and may be vulnerable.


Tableau Server

Severity: Medium
CVSS3 Score: AV:N AC:L PR:L UI:N S:U C:H I:N A:N - 6.5 Medium


Vulnerable versions:

  • Tableau Server on Windows 10.2 through 10.2.20
  • Tableau Server on Windows 10.3 through 10.3.20
  • Tableau Server on Windows 10.4 through 10.4.16
  • Tableau Server on Windows 10.5 through 10.5.15
  • Tableau Server on Windows 2018.1 through 2018.1.12
  • Tableau Server on Windows 2018.2 through 2018.2.9
  • Tableau Server on Windows 2018.3 through 2018.3.6
  • Tableau Server on Windows 2019.1 through 2019.1.3
  • Tableau Server on Windows 2019.2

 

  • Tableau Server on Linux 10.5 through 10.5.15
  • Tableau Server on Linux 2018.1 through 2018.1.12
  • Tableau Server on Linux 2018.2 through 2018.2.9
  • Tableau Server on Linux 2018.3 through 2018.3.6
  • Tableau Server on Linux 2019.1 through 2019.1.3
  • Tableau Server on Linux 2019.2


Resolved in versions:

  • Tableau Server on Windows 10.2.21
  • Tableau Server on Windows 10.3.21
  • Tableau Server on Windows 10.4.17
  • Tableau Server on Windows 10.5.16
  • Tableau Server on Windows 2018.1.13
  • Tableau Server on Windows 2018.2.10
  • Tableau Server on Windows 2018.3.7
  • Tableau Server on Windows 2019.1.4
  • Tableau Server on Windows 2019.2.1

 

  • Tableau Server on Linux 10.5.16
  • Tableau Server on Linux 2018.1.13
  • Tableau Server on Linux 2018.2.10
  • Tableau Server on Linux 2018.3.7
  • Tableau Server on Linux 2019.1.4
  • Tableau Server on Linux 2019.2.1


Tableau Desktop (Back to top of page)

Severity: N/A
CVSS3 Score: N/A
Product specific notes: Not affected.


Tableau Bridge (Back to top of page)

Severity: N/A
CVSS3 Score: N/A
Product specific notes: Not affected.


Tableau Prep Builder (Back to top of page)

Severity: N/A
CVSS3 Score: N/A
Product specific notes: Not affected.


Tableau Reader (Back to top of page)

Severity: N/A
CVSS3 Score: N/A
Product specific notes: Not affected.


Tableau Mobile (Back to top of page)

Severity: N/A
CVSS3 Score: N/A
Product specific notes: Not affected.


Tableau Public Desktop (Back to top of page)

Severity: N/A
CVSS3 Score: N/A
Product specific notes: Not affected.

Highest overall severity: Medium


Summary:

Tableau Server SAML implementation fails to properly validate the final destination URL.


Impact:

A Tableau Server user that clicks on a malicious link and completes a SAML login will be redirected to an attacker controlled location. No SAML request or response is sent to the final location.


Products and Versions: Tableau Server | Tableau Desktop | Tableau Bridge | Tableau Prep Builder | Tableau Reader | Tableau Mobile | Tableau Public Desktop
Versions that are no longer supported are not tested and may be vulnerable.


Tableau Server

Severity: Medium
CVSS3 Score: AV:N AC:L PR:N UI:R S:U C:N I:L A:N - 4.3 Medium
Product specific notes:
       This only affects Tableau Server instances configured with Server-Wide SAML


Vulnerable versions:

  • Tableau Server on Windows 10.2 through 10.2.20
  • Tableau Server on Windows 10.3 through 10.3.20
  • Tableau Server on Windows 10.4 through 10.4.16
  • Tableau Server on Windows 10.5 through 10.5.15
  • Tableau Server on Windows 2018.1 through 2018.1.12
  • Tableau Server on Windows 2018.2 through 2018.2.9
  • Tableau Server on Windows 2018.3 through 2018.3.6
  • Tableau Server on Windows 2019.1 through 2019.1.3
  • Tableau Server on Windows 2019.2.0

  • Tableau Server on Linux 10.5 through 10.5.15
  • Tableau Server on Linux 2018.1 through 2018.1.12
  • Tableau Server on Linux 2018.2 through 2018.2.9
  • Tableau Server on Linux 2018.3 through 2018.3.6
  • Tableau Server on Linux 2019.1 through 2019.1.3
  • Tableau Server on Linux 2019.2.0


Resolved in versions:

  • Tableau Server on Windows 10.2.21
  • Tableau Server on Windows 10.3.21
  • Tableau Server on Windows 10.4.17
  • Tableau Server on Windows 10.5.16
  • Tableau Server on Windows 2018.1.13
  • Tableau Server on Windows 2018.2.10
  • Tableau Server on Windows 2018.3.7
  • Tableau Server on Windows 2019.1.4
  • Tableau Server on Windows 2019.2.1

 

  • Tableau Server on Linux 10.5.16
  • Tableau Server on Linux 2018.1.13
  • Tableau Server on Linux 2018.2.10
  • Tableau Server on Linux 2018.3.7
  • Tableau Server on Linux 2019.1.4
  • Tableau Server on Linux 2019.2.1


Tableau Desktop (Back to top of page)

Severity: N/A
CVSS3 Score: N/A
Product specific notes: Not affected.


Tableau Bridge (Back to top of page)

Severity: N/A
CVSS3 Score: N/A
Product specific notes: Not affected.


Tableau Prep Builder (Back to top of page)

Severity: N/A
CVSS3 Score: N/A
Product specific notes: Not affected.


Tableau Reader (Back to top of page)

Severity: N/A
CVSS3 Score: N/A
Product specific notes: Not affected. - Tableau Reader 10.0


Tableau Mobile (Back to top of page)

Severity: N/A
CVSS3 Score: N/A
Product specific notes: Not affected.


Tableau Public Desktop (Back to top of page)

Severity: N/A
CVSS3 Score: N/A
Product specific notes: Not affected.

Highest overall severity: Medium


Summary:

Workbooks that use user functions inside a context filter may not properly filter data the first time a view is loaded due to a caching issue.


Impact:

A user with access to a published workbook can see unfiltered data for another user resulting in information disclosure within that same workbook. A malicious user cannot directly force this to happen.


Products and Versions: Tableau Server | Tableau Desktop | Tableau Bridge | Tableau Prep Builder | Tableau Reader | Tableau Mobile | Tableau Public Desktop
Versions that are no longer supported are not tested and may be vulnerable.


Tableau Server

Severity: Medium
CVSS3 Score: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - 6.5 Medium


Vulnerable versions:

  • Tableau Server on Windows 10.2 through 10.2.20
  • Tableau Server on Windows 10.3 through 10.3.20
  • Tableau Server on Windows 10.4 through 10.4.16
  • Tableau Server on Windows 10.5 through 10.5.15
  • Tableau Server on Windows 2018.1 through 2018.1.12
  • Tableau Server on Windows 2018.2 through 2018.2.9
  • Tableau Server on Windows 2018.3 through 2018.3.6
  • Tableau Server on Windows 2019.1 through 2019.1.3

  • Tableau Server on Linux 10.5 through 10.5.15
  • Tableau Server on Linux 2018.1 through 2018.1.12
  • Tableau Server on Linux 2018.2 through 2018.2.9
  • Tableau Server on Linux 2018.3 through 2018.3.6
  • Tableau Server on Linux 2019.1 through 2019.1.3


Resolved in versions:

  • Tableau Server on Windows 10.2.21
  • Tableau Server on Windows 10.3.21
  • Tableau Server on Windows 10.4.17
  • Tableau Server on Windows 10.5.16
  • Tableau Server on Windows 2018.1.13
  • Tableau Server on Windows 2018.2.10
  • Tableau Server on Windows 2018.3.7
  • Tableau Server on Windows 2019.1.4

  • Tableau Server on Linux 10.5.16
  • Tableau Server on Linux 2018.1.13
  • Tableau Server on Linux 2018.2.10
  • Tableau Server on Linux 2018.3.7
  • Tableau Server on Linux 2019.1.4


Tableau Desktop (Back to top of page)

Severity: N/A
CVSS3 Score: N/A
Product specific notes: Not affected.


Tableau Bridge (Back to top of page)

Severity: N/A
CVSS3 Score: N/A
Product specific notes: Not affected. - Tableau Bridge 10.0


Tableau Prep Builder (Back to top of page)

Severity: N/A
CVSS3 Score: N/A
Product specific notes: Not affected.


Tableau Reader (Back to top of page)

Severity: N/A
CVSS3 Score: N/A
Product specific notes: Not affected.


Tableau Mobile (Back to top of page)

Severity: N/A
CVSS3 Score: N/A
Product specific notes: Not affected.


Tableau Public Desktop (Back to top of page)

Severity: N/A
CVSS3 Score: N/A
Product specific notes: Not affected.

Highest overall severity: Medium


Summary:

A workbook published to Tableau Server with a datasource that has been set to "Publish Separately" and an authentication choice of "Prompt" will publish in an unexpected way. The separate datasource will be published with authentication set to "Prompt". However, the workbook will be published with a connection to the new datasource and the authentication is set to "Embedded Password".


Impact:

A Tableau Server user that has access to the workbook will be able to open the workbook and use the embedded credentials to connect to the datasource.


Products and Versions: Tableau Server | Tableau Desktop | Tableau Bridge | Tableau Prep Builder | Tableau Reader | Tableau Mobile | Tableau Public Desktop
Versions that are no longer supported are not tested and may be vulnerable.


Tableau Server

Severity: N/A
CVSS3 Score: N/A
Product specific notes: Not affected.


Tableau Desktop (Back to top of page)

Severity: Medium
CVSS3 Score: AV:N AC:L PR:L UI:N S:U C:H I:N A:N - 6.5 Medium


Vulnerable versions:

  • Tableau Desktop on Windows 10.2 through 10.2.20
  • Tableau Desktop on Windows 10.3 through 10.3.20
  • Tableau Desktop on Windows 10.4 through 10.4.16
  • Tableau Desktop on Windows 10.5 through 10.5.15
  • Tableau Desktop on Windows 2018.1 through 2018.1.12
  • Tableau Desktop on Windows 2018.2 through 2018.2.9
  • Tableau Desktop on Windows 2018.3 through 2018.3.6
  • Tableau Desktop on Windows 2019.1 through 2019.1.3

  • Tableau Desktop on Mac 10.2 through 10.2.20
  • Tableau Desktop on Mac 10.3 through 10.3.20
  • Tableau Desktop on Mac 10.4 through 10.4.16
  • Tableau Desktop on Mac 10.5 through 10.5.15
  • Tableau Desktop on Mac 2018.1 through 2018.1.12
  • Tableau Desktop on Mac 2018.2 through 2018.2.9
  • Tableau Desktop on Mac 2018.3 through 2018.3.6
  • Tableau Desktop on Mac 2019.1 through 2019.1.3


Resolved in versions:

  • Tableau Desktop on Windows 10.2.21
  • Tableau Desktop on Windows 10.3.21
  • Tableau Desktop on Windows 10.4.17
  • Tableau Desktop on Windows 10.5.16
  • Tableau Desktop on Windows 2018.1.13
  • Tableau Desktop on Windows 2018.2.10
  • Tableau Desktop on Windows 2018.3.7
  • Tableau Desktop on Windows 2019.1.4

  • Tableau Desktop on Mac 10.2.21
  • Tableau Desktop on Mac 10.3.21
  • Tableau Desktop on Mac 10.4.17
  • Tableau Desktop on Mac 10.5.16
  • Tableau Desktop on Mac 2018.1.13
  • Tableau Desktop on Mac 2018.2.10
  • Tableau Desktop on Mac 2018.3.7
  • Tableau Desktop on Mac 2019.1.4


Tableau Bridge (Back to top of page)

Severity: N/A
CVSS3 Score: N/A
Product specific notes: Not affected.


Tableau Prep Builder (Back to top of page)

Severity: N/A
CVSS3 Score: N/A
Product specific notes: Not affected.


Tableau Reader (Back to top of page)

Severity: N/A
CVSS3 Score: N/A
Product specific notes: Not affected.


Tableau Mobile (Back to top of page)

Severity: N/A
CVSS3 Score: N/A
Product specific notes: Not affected.


Tableau Public Desktop (Back to top of page)

Severity: N/A
CVSS3 Score: N/A
Product specific notes: Not affected.

Highest overall severity: Medium


Summary:

Tableau Server generates an error page that contains a user-supplied string.


Impact:

A user that clicks on a link will be presented an error message that contains a string entered by another user.


Products and Versions: Tableau Server | Tableau Desktop | Tableau Bridge | Tableau Prep Builder | Tableau Reader | Tableau Mobile | Tableau Public Desktop
Versions that are no longer supported are not tested and may be vulnerable.


Tableau Server

Severity: Medium

CVSS3 Score: AV:N AC:L PR:N UI:R S:C C:N I:L A:N - 4.7 Medium


Vulnerable versions:

  • Tableau Server on Windows 2018.2 through 2018.2.9
  • Tableau Server on Windows 2018.3 through 2018.3.6
  • Tableau Server on Windows 2019.1 through 2019.1.3

  • Tableau Server on Windows 2018.2 through 2018.2.9
  • Tableau Server on Windows 2018.3 through 2018.3.6
  • Tableau Server on Windows 2019.1 through 2019.1.3


Resolved in versions:

  • Tableau Server on Windows 2018.2.10
  • Tableau Server on Windows 2019.3.7
  • Tableau Server on Windows 2019.1.4

  • Tableau Server on Linux 2018.2.10
  • Tableau Server on Linux 2019.3.7
  • Tableau Server on Linux 2019.1.4


Tableau Desktop (Back to top of page)

Severity: N/A

CVSS3 Score: N/A

Product specific notes:  Not affected.


Tableau Bridge (Back to top of page)

Severity: N/A

CVSS3 Score: N/A

Product specific notes:  Not affected.


Tableau Prep Builder (Back to top of page)

Severity: N/A

CVSS3 Score: N/A

Product specific notes:  Not affected.


Tableau Reader (Back to top of page)

Severity: N/A

CVSS3 Score: N/A

Product specific notes:  Not affected.


Tableau Mobile (Back to top of page)

Severity: N/A
CVSS3 Score: N/A
Product specific notes: Not affected.


Tableau Public Desktop (Back to top of page)

Severity: N/A

CVSS3 Score: N/A

Product specific notes:  Not affected.

Severity: Medium

 

Summary: Tableau Prep does not properly validate filenames when opening a maliciously-crafted Packaged Tableau Flow File (.tflx). The resulting files can be written outside of the intended temporary location.

 

Impact: A Tableau Prep user who opens a maliciously-crafted Tableau Flow File can unknowingly write and overwrite files to any location the user has access to.

 

Vulnerable Versions:  The following versions have this vulnerability:

Tableau Prep: 2018.1 through 2018.1.2

 

Resolution: The issue can be fixed by upgrading to the following version:

Tableau Prep: 2018.2.1

Summary: Tableau Software has confirmed that currently supported versions of Tableau Server are not impacted by CVE-2017-12615, CVE-2017-12616 or CVE-2017-12617. 

 

Tableau Server uses a vulnerable version of Apache Tomcat, but the implementation does not set the readonly initialization parameter, as specified in CVE-2017-12615 and CVE-2017-12617.   Additionally, Tableau Server does not implement VirtualDirContexts as specified in CVE-2017-12616. 

 

Apache Tomcat will be updated to a later version in a future maintenance release.  

Severity: High

 

Summary: Tableau Desktop and Tableau server uses a version of FlexNet Publisher that contains a vulnerability. The vulnerability can be exploited by malicious, local users on Windows systems.

 

Impact: Attackers may gain elevated privileges on the computer running Tableau Desktop for Windows or on Tableau Server.

Vulnerable Versions: Tableau Desktop for Windows and Tableau Server 9.0.0 (through 9.0.23), 9.1.0 (through 9.1.20), 9.2.0 (through 9.2.19) 9.3.0 (through 9.3.17), 10.0.0 (through 10.0.12), 10.1.0 (through 10.1.10), 10.2.0 (through 10.2.4), 10.3.0 (through 10.3.2) and 10.4.0.

 

Mitigation: None.

 

Resolution: The issue can be fixed by upgrading to the following versions:

 

Tableau Server and Tableau Desktop 9.0.24

Tableau Server and Tableau Desktop 9.1.21

Tableau Server and Tableau Desktop 9.2.20

Tableau Server and Tableau Desktop 9.3.18

Tableau Server and Tableau Desktop 10.0.13

Tableau Server and Tableau Desktop 10.1.11

Tableau Server and Tableau Desktop 10.2.5

Tableau Server and Tableau Desktop 10.3.3

Tableau Server and Tableau Desktop 10.4.1

 

More information: https://nvd.nist.gov/vuln/detail/CVE-2016-10395

 

Updates:

 

9/20/17 - corrected Resolution to include Tableau Desktop

9/25/17 - added 10.4 to the Vulnerable Versions List

10/18/17 - updated Resolution to include versions 9.0-9.3

11/9/17 - updated Resolution to include version 10.4

Severity: Medium

 

Summary: The latest release of Tableau Server includes an updated version of Apache HTTPD (2.4.26). Apache HTTPD 2.4.26 fixes five vulnerabilities. Specifically, Apache HTTPD 2.4.26 fixes a MIME overread vulnerability (CVE-2017-7679) that exposes the potential to disclose sensitive information.

 

Impact: A malicious exploit of the MIME overread vulnerability could result in sensitive information disclosure.

 

Vulnerable Versions: Tableau Server 9.0.0 (through 9.0.23), 9.1.0 (through 9.1.20), 9.2.0 (through 9.2.19) 9.3.0 (through 9.3.17), 10.0.0 (through 10.0.12), 10.1.0 (through 10.1.10), 10.2.0 (through 10.2.4), 10.3.0 (through 10.3.2)

 

Resolution: The issue can be fixed by upgrading to the following versions:

 

Tableau Server 9.0.24

Tableau Server 9.1.21

Tableau Server 9.2.20

Tableau Server 9.3.18

Tableau Server 10.0.13

Tableau Server 10.1.11

Tableau Server 10.2.5

Tableau Server 10.3.3

 

More information: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7679

 

Updates:

10/18/2017 - updated resolution to include fixes in 9.0 through 9.3

Severity: Medium

 

Summary: Tableau Server writes some sensitive information to the log files in plain text.

 

Impact: Malicious users with access to Tableau logs may be able to access passwords to data sources.

 

Vulnerable Versions: 10.3.0 (through 10.3.2)

 

Resolution: The issue can be fixed by upgrading to the following version:

 

Tableau Server 10.3.3

Severity: High

 

Summary: A vulnerable version of Tableau Server configured for Site SAML contains a flaw that can be exploited by an attacker to log into a site that they are not a member of. The attacker must have site administrator privileges on a site on the same server.

Impact: An attacker could log into a site they do not have access to.

 

Vulnerable Versions: 10.0(through 10.0.12), 10.1 (through 10.1.10), 10.2 (through 10.2.4), 10.3 (through 10.3.2)

 

Resolution: The issue can be fixed by upgrading to the following versions:

 

Tableau Server 10.0.13

Tableau Server 10.1.11

Tableau Server 10.2.5

Tableau Server 10.3.3

Severity: High

 

Summary:  An attacker can specially craft a Tableau Workbook to execute code on a victim's machine.  The attacker must convince the user to open the workbook to complete the attack. 

 

Vulnerable Versions: Tableau Desktop, Reader and Public 8.2.0 (through 8.2.19), 8.3.0 (through 8.3.14), 9.0.0 (through 9.0.16), 9.1.0 (through 9.1.12), 9.2.0 (through 9.2.11), 9.3.0 (through 9.3.6), 10.0.0

 

Resolution: The issue can be fixed by upgrading to the following Tableau Server versions:

Tableau Server 8.2.20

Tableau Server 8.3.15

Tableau Server 9.0.17

Tableau Server 9.1.13

Tableau Server 9.2.11

Tableau Server 9.3.7

Tableau Server 10.0.1

 

Workaround:  None

 

Acknowledgement:  This issue was found internally

Severity: Medium

 

Summary:  An authenticated attacker with low privileges (that is, even a user who is not an administrator) can send a specially crafted message to Tableau Server that makes Tableau Server unresponsive for an extended period of time.

 

 

Vulnerable Versions: Tableau Server 10.0.0

 

Resolution: The issue can be fixed by upgrading to the following Tableau Server versions:

Tableau Server 10.0.1

 

Workaround:  None

 

Acknowledgement:  This issue was found internally

Severity:  Medium

 

Summary: Under certain conditions, information prepared for one user might be displayed to another user. For this problem to occur, both users must be looking at the same view, the view must be connected to a data source that returns different attribute values for each user, and the view must not have any user filters or user-specific calculations.

 

Vulnerable Versions: Tableau Server 9.1.0 (through 9.1.12), 9.2.0 (through 9.2.10), 9.3.0 (through 9.3.5), 10.0.0

 

Resolution: The issue can be fixed by upgrading to the following Tableau Server versions:

Tableau Server 9.1.13

Tableau Server 9.2.11

Tableau Server 9.3.6

Tableau Server 10.0.1

 

Workaround: Customers whose deployment meets the conditions of the vulnerability should upgrade to a non-vulnerable version as soon as possible.

 

 

As a temporary measure, you can use either of the following mitigations:

  • Use the following command to disable the model cache on Tableau Server:

tabadmin set vizqlserver.modelcachesize 0

 

This change might impact the performance of Tableau Server, so we recommend reverting this setting after installing the Tableau upgrade.

 

Acknowledgement:  This vulnerability was reported to Tableau by a customer

Severity: Medium

 

Summary: An authenticated attacker with the ability to upload or edit a workbook might be able to trigger a cross-site scripting (XSS) vulnerability in Tableau Server. 

 

Vulnerable Versions: Tableau Server 8.2.0 (through 8.2.19), 8.3.0 (through 8.3.14), 9.0.0 (through 9.0.16), 9.1.0 (through 9.1.12), 9.2.0 (through 9.2.11), 9.3.0 (through 9.3.6), 10.0.0

 

Workaround:  None

 

Resolution: The issue can be fixed by upgrading to the following Tableau Server versions:

Tableau Server 8.2.20

Tableau Server 8.3.15

Tableau Server 9.0.17

Tableau Server 9.1.13

Tableau Server 9.2.12

Tableau Server 9.3.7

Tableau Server 10.0.1

 

Acknowledgement:  This issue was found internally