CVE-2020-6939

Tableau Server installations configured with Site-Specific SAML that allows the APIs to be used by unauthenticated users. If exploited, this could allow a malicious user to configure Site-Specific SAML settings and could lead to account takeover for users of that site. Tableau Server versions affected on both Windows and Linux are: 2018.2 through 2018.2.27, 2018.3 through 2018.3.24, 2019.1 through 2019.1.22, 2019.2 through 2019.2.18, 2019.3 through 2019.3.14, 2019.4 through 2019.4.13, 2020.1 through 2020.1.10, 2020.2 through 2020.2.7, and 2020.3 through 2020.3.2.

CVSS v3 9.8 CRITICAL
CVSS v2.0 10.0 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://help.salesforce.com/articleView?id=000355686&type=1&mode=1	Third Party Advisory
https://help.salesforce.com/articleView?id=000355686&type=1&mode=1	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:tableau:tableau_server::::::::
	cpe:2.3:a:tableau:tableau_server::::::::
	cpe:2.3:a:tableau:tableau_server::::::::
	cpe:2.3:a:tableau:tableau_server::::::::
	cpe:2.3:a:tableau:tableau_server::::::::
	cpe:2.3:a:tableau:tableau_server::::::::
	cpe:2.3:a:tableau:tableau_server::::::::
	cpe:2.3:a:tableau:tableau_server::::::::
	cpe:2.3:a:tableau:tableau_server::::::::

History

21 Nov 2024, 05:36

Type	Values Removed	Values Added
References	~~() https://help.salesforce.com/articleView?id=000355686&type=1&mode=1 - Third Party Advisory~~	() https://help.salesforce.com/articleView?id=000355686&type=1&mode=1 - Third Party Advisory

Information

Published : 2020-11-23 17:15

Updated : 2024-11-21 05:36

NVD link : CVE-2020-6939

Mitre link : CVE-2020-6939

CVE.ORG link : CVE-2020-6939

JSON object : View

Products Affected

tableau

tableau_server

CWE

NVD-CWE-noinfo

{"id": "CVE-2020-6939", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2020-11-23T17:15:12.720", "references": [{"url": "https://help.salesforce.com/articleView?id=000355686&type=1&mode=1", "tags": ["Third Party Advisory"], "source": "security@salesforce.com"}, {"url": "https://help.salesforce.com/articleView?id=000355686&type=1&mode=1", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Tableau Server installations configured with Site-Specific SAML that allows the APIs to be used by unauthenticated users. If exploited, this could allow a malicious user to configure Site-Specific SAML settings and could lead to account takeover for users of that site. Tableau Server versions affected on both Windows and Linux are: 2018.2 through 2018.2.27, 2018.3 through 2018.3.24, 2019.1 through 2019.1.22, 2019.2 through 2019.2.18, 2019.3 through 2019.3.14, 2019.4 through 2019.4.13, 2020.1 through 2020.1.10, 2020.2 through 2020.2.7, and 2020.3 through 2020.3.2."}, {"lang": "es", "value": "Instalaciones de Tableau Server configuradas con Site-Specific SAML que permite a usuarios no autenticados utilizar las API. Si se explota, esto podr\u00eda permitir a un usuario malicioso establecer la configuraci\u00f3n SAML espec\u00edfica del sitio y podr\u00eda conllevar a la toma de control de la cuenta para los usuarios de ese sitio. Tableau Server versiones afectadas tanto en Windows como en Linux son: 2018.2 hasta 2018.2.27, 2018.3 hasta 2018.3.24, 2019.1 hasta 2019.1.22, 2019.2 hasta 2019.2.18, 2019.3 hasta 2019.3.14, 2019.4 hasta 2019.4.13, 2020.1 hasta 2020.1.10, 2020.2 hasta 2020.2.7 y 2020.3 hasta 2020.3.2"}], "lastModified": "2024-11-21T05:36:22.330", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tableau:tableau_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "18E26A40-022A-4887-85CE-E0BFF83F7299", "versionEndIncluding": "2018.2.27", "versionStartIncluding": "2018.2"}, {"criteria": "cpe:2.3:a:tableau:tableau_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7B72068B-B413-4053-B1BC-0CD154D10D8D", "versionEndIncluding": "2018.3.24", "versionStartIncluding": "2018.3"}, {"criteria": "cpe:2.3:a:tableau:tableau_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "52F0B5EB-D5F4-4423-8754-E9BCC3699305", "versionEndIncluding": "2019.1.22", "versionStartIncluding": "2019.1"}, {"criteria": "cpe:2.3:a:tableau:tableau_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "56EB08BB-13A4-49C9-8928-DFD0DFA8D4AE", "versionEndIncluding": "2019.2.18", "versionStartIncluding": "2019.2"}, {"criteria": "cpe:2.3:a:tableau:tableau_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4401C018-6851-4211-83B1-E5595A746116", "versionEndIncluding": "2019.3.14", "versionStartIncluding": "2019.3"}, {"criteria": "cpe:2.3:a:tableau:tableau_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EFC0F0E8-FEB5-45AB-9D12-5592549E9408", "versionEndIncluding": "2019.4.13", "versionStartIncluding": "2019.4"}, {"criteria": "cpe:2.3:a:tableau:tableau_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "06E3D4C4-6466-420B-AF73-4C2964D3F0A7", "versionEndIncluding": "2020.1.10", "versionStartIncluding": "2020.1"}, {"criteria": "cpe:2.3:a:tableau:tableau_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DCE3600B-1D06-4A80-919D-32E2DA3ABFC0", "versionEndIncluding": "2020.2.7", "versionStartIncluding": "2020.2"}, {"criteria": "cpe:2.3:a:tableau:tableau_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C60C48CC-A038-4AA3-95EE-045AB2F6D047", "versionEndIncluding": "2020.3.2", "versionStartIncluding": "2020.3"}], "operator": "OR"}]}], "sourceIdentifier": "security@salesforce.com"}