Vulnerability-Lookup

CNVD-2021-24349

Vulnerability from cnvd - Published: 2021-04-01

Title

Tableau Server users开放重定向漏洞

Description

Tableau Server是一套文件托管服务器。该产品主要用于管理、共享Tableau Desktop数据可视化软件创建的数据可视化、交互式仪表板、工作簿和报告等。 Tableau users存在安全漏洞，该漏洞源于服务器无法验证发送给用户的邮件中嵌入的某些url。目前没有详细的漏洞细节提供。

Severity

中

Patch Name

Tableau Server users开放重定向漏洞的补丁

Patch Description

Tableau Server是一套文件托管服务器。该产品主要用于管理、共享Tableau Desktop数据可视化软件创建的数据可视化、交互式仪表板、工作簿和报告等。 Tableau users存在安全漏洞，该漏洞源于服务器无法验证发送给用户的邮件中嵌入的某些url。目前没有详细的漏洞细节提供。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://help.salesforce.com/articleView?id=000357384&type=1&mode=1

Reference

https://nvd.nist.gov/vuln/detail/CVE-2021-1629

Impacted products

Name
['Tableau Tableau Server on Linux >=2019.4，<=2019.4.17', 'Tableau Tableau Server on Linux >=2020.1，<=2020.1.13', 'Tableau Tableau Server on Linux >=2020.2，<=2020.2.10', 'Tableau Tableau Server on Linux >=2020.3，<=2020.3.6', 'Tableau Tableau Server on Linux >=2020.4，<=2020.4.2', 'Tableau Tableau Server on Windows >=2019.4，<=2019.4.17', 'Tableau Tableau Server on Windows >=2020.1，<=2020.1.13', 'Tableau Tableau Server on Windows >=2020.2，<=2020.2.10', 'Tableau Tableau Server on Windows >=2020.3，<=2020.3.6', 'Tableau Tableau Server on Windows >=2020.4，<=2020.4.2']

Name

['Tableau Tableau Server on Linux >=2019.4，<=2019.4.17', 'Tableau Tableau Server on Linux >=2020.1，<=2020.1.13', 'Tableau Tableau Server on Linux >=2020.2，<=2020.2.10', 'Tableau Tableau Server on Linux >=2020.3，<=2020.3.6', 'Tableau Tableau Server on Linux >=2020.4，<=2020.4.2', 'Tableau Tableau Server on Windows >=2019.4，<=2019.4.17', 'Tableau Tableau Server on Windows >=2020.1，<=2020.1.13', 'Tableau Tableau Server on Windows >=2020.2，<=2020.2.10', 'Tableau Tableau Server on Windows >=2020.3，<=2020.3.6', 'Tableau Tableau Server on Windows >=2020.4，<=2020.4.2']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-1629"
    }
  },
  "description": "Tableau Server\u662f\u4e00\u5957\u6587\u4ef6\u6258\u7ba1\u670d\u52a1\u5668\u3002\u8be5\u4ea7\u54c1\u4e3b\u8981\u7528\u4e8e\u7ba1\u7406\u3001\u5171\u4eabTableau Desktop\u6570\u636e\u53ef\u89c6\u5316\u8f6f\u4ef6\u521b\u5efa\u7684\u6570\u636e\u53ef\u89c6\u5316\u3001\u4ea4\u4e92\u5f0f\u4eea\u8868\u677f\u3001\u5de5\u4f5c\u7c3f\u548c\u62a5\u544a\u7b49\u3002\n\nTableau users\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u670d\u52a1\u5668\u65e0\u6cd5\u9a8c\u8bc1\u53d1\u9001\u7ed9\u7528\u6237\u7684\u90ae\u4ef6\u4e2d\u5d4c\u5165\u7684\u67d0\u4e9burl\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://help.salesforce.com/articleView?id=000357384\u0026type=1\u0026mode=1",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-24349",
  "openTime": "2021-04-01",
  "patchDescription": "Tableau Server\u662f\u4e00\u5957\u6587\u4ef6\u6258\u7ba1\u670d\u52a1\u5668\u3002\u8be5\u4ea7\u54c1\u4e3b\u8981\u7528\u4e8e\u7ba1\u7406\u3001\u5171\u4eabTableau Desktop\u6570\u636e\u53ef\u89c6\u5316\u8f6f\u4ef6\u521b\u5efa\u7684\u6570\u636e\u53ef\u89c6\u5316\u3001\u4ea4\u4e92\u5f0f\u4eea\u8868\u677f\u3001\u5de5\u4f5c\u7c3f\u548c\u62a5\u544a\u7b49\u3002\r\n\r\nTableau users\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u670d\u52a1\u5668\u65e0\u6cd5\u9a8c\u8bc1\u53d1\u9001\u7ed9\u7528\u6237\u7684\u90ae\u4ef6\u4e2d\u5d4c\u5165\u7684\u67d0\u4e9burl\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Tableau Server users\u5f00\u653e\u91cd\u5b9a\u5411\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Tableau Tableau Server on Linux \u003e=2019.4\uff0c\u003c=2019.4.17",
      "Tableau Tableau Server on Linux \u003e=2020.1\uff0c\u003c=2020.1.13",
      "Tableau Tableau Server on Linux \u003e=2020.2\uff0c\u003c=2020.2.10",
      "Tableau Tableau Server on Linux \u003e=2020.3\uff0c\u003c=2020.3.6",
      "Tableau Tableau Server on Linux \u003e=2020.4\uff0c\u003c=2020.4.2",
      "Tableau Tableau Server on Windows \u003e=2019.4\uff0c\u003c=2019.4.17",
      "Tableau Tableau Server on Windows \u003e=2020.1\uff0c\u003c=2020.1.13",
      "Tableau Tableau Server on Windows \u003e=2020.2\uff0c\u003c=2020.2.10",
      "Tableau Tableau Server on Windows \u003e=2020.3\uff0c\u003c=2020.3.6",
      "Tableau Tableau Server on Windows \u003e=2020.4\uff0c\u003c=2020.4.2"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2021-1629",
  "serverity": "\u4e2d",
  "submitTime": "2021-03-30",
  "title": "Tableau Server users\u5f00\u653e\u91cd\u5b9a\u5411\u6f0f\u6d1e"
}

CVE-2021-1629 (GCVE-0-2021-1629)

Vulnerability from cvelistv5 – Published: 2021-03-26 16:20 – Updated: 2024-08-03 16:18

Summary

Tableau Server fails to validate certain URLs that are embedded in emails sent to Tableau Server users.

Severity

No CVSS data available.

CWE

Other or Unknown

Assigner

Salesforce mitre root

References

3 references

URL	Tags
https://help.salesforce.com/articleView?id=000357…	x_refsource_MISC
http://seclists.org/fulldisclosure/2021/Apr/22	mailing-listx_refsource_FULLDISC
http://packetstormsecurity.com/files/162138/Table…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
n/a	Tableau	Affected: Tableau Server versions affected on both Windows and Linux are: 2019.4 through 2019.4.17 2020.1 through 2020.1.13 2020.2 through 2020.2.10 2020.3 through 2020.3.6 2020.4 through 2020.4.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T16:18:10.880Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://help.salesforce.com/articleView?id=000357424\u0026type=1\u0026mode=1"
          },
          {
            "name": "20210408 [SYSS-2020-032] Open Redirect in Tableau Server (CVE-2021-1629)",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2021/Apr/22"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/162138/Tableau-Server-Open-Redirection.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Tableau",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Tableau Server versions affected on both Windows and Linux are: 2019.4 through 2019.4.17 2020.1 through 2020.1.13 2020.2 through 2020.2.10 2020.3 through 2020.3.6 2020.4 through 2020.4.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Tableau Server fails to validate certain URLs that are embedded in emails sent to Tableau Server users."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Other or Unknown",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-04-08T15:06:19.000Z",
        "orgId": "c9b25dee-ae6d-4083-ba23-638c500cc364",
        "shortName": "Salesforce"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://help.salesforce.com/articleView?id=000357424\u0026type=1\u0026mode=1"
        },
        {
          "name": "20210408 [SYSS-2020-032] Open Redirect in Tableau Server (CVE-2021-1629)",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2021/Apr/22"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/162138/Tableau-Server-Open-Redirection.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@salesforce.com",
          "ID": "CVE-2021-1629",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Tableau",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Tableau Server versions affected on both Windows and Linux are: 2019.4 through 2019.4.17 2020.1 through 2020.1.13 2020.2 through 2020.2.10 2020.3 through 2020.3.6 2020.4 through 2020.4.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Tableau Server fails to validate certain URLs that are embedded in emails sent to Tableau Server users."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Other or Unknown"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://help.salesforce.com/articleView?id=000357424\u0026type=1\u0026mode=1",
              "refsource": "MISC",
              "url": "https://help.salesforce.com/articleView?id=000357424\u0026type=1\u0026mode=1"
            },
            {
              "name": "20210408 [SYSS-2020-032] Open Redirect in Tableau Server (CVE-2021-1629)",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2021/Apr/22"
            },
            {
              "name": "http://packetstormsecurity.com/files/162138/Tableau-Server-Open-Redirection.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/162138/Tableau-Server-Open-Redirection.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c9b25dee-ae6d-4083-ba23-638c500cc364",
    "assignerShortName": "Salesforce",
    "cveId": "CVE-2021-1629",
    "datePublished": "2021-03-26T16:20:28.000Z",
    "dateReserved": "2020-12-02T00:00:00.000Z",
    "dateUpdated": "2024-08-03T16:18:10.880Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CNVD-2021-24349

CVE-2021-1629 (GCVE-0-2021-1629)

Tags

Sightings

Nomenclature

Related by attack behaviour