Vulnerability · Published Mar 26, 2021 · Assigned by Salesforce

CVE-2021-1629

Medium 6.1

In plain English

A medium-severity security flaw in Tableau. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities).

Severity (CVSS NVD)6.1Medium

Exploit odds (30 days)1.3%top 28.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Tableau Server fails to validate certain URLs that are embedded in emails sent to Tableau Server users.

Affected products (as reported)

Vendor	Product	Versions
n/a	Tableau	Tableau Server versions affected on both Windows and Linux are: 2019.4 through 2019.4.17 2020.1 through 2020.1.13 2020.2 through 2020.2.10 2020.3 through 2020.3.6 2020.4 through 2020.4.2

References

https://help.salesforce.com/articleView?id=000357424&type=1&mode=1 x_refsource_MISC
20210408 [SYSS-2020-032] Open Redirect in Tableau Server (CVE-2021-1629) mailing-list, x_refsource_FULLDISC
http://packetstormsecurity.com/files/162138/Tableau-Server-Open-Redirection.html x_refsource_MISC