NetSight
IP …
high8.1Public exploit code

CVE-2019-15637

Numerous Tableau products are vulnerable to XXE via a malicious workbook, extension, or data source, leading to information disclosure or a DoS.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Numerous Tableau products are vulnerable to XXE via a malicious workbook, extension, or data source, leading to information disclosure or a DoS. This affects Tableau Server, Tableau Desktop, Tableau Reader, and Tableau Public Desktop.

Affected products

VendorProductAffected versions
TableauTableau Server
from 10.5 through 10.5.18
from 2018.1 through 2018.1.15
from 2018.2 through 2018.12
from 2018.3 through 2018.3.9
from 2019.1 through 2019.1.6
from 2019.2 through 2019.2.2
TableauTableau Desktop
from 10.2 through 10.2.23
from 10.3 through 10.3.23
from 10.4 through 10.4.19
from 10.5 through 10.5.18
from 2018.1 through 2018.1.15
from 2018.2 through 2018.2.12
TableauTableau Reader
from 10.2 through 10.2.2
TableauTableau Public Desktop
from 10.2 through 10.2.2

Weakness classification

CWE-611

References