CVE-2020-6939

Description

Tableau Server installations configured with Site-Specific SAML that allows the APIs to be used by unauthenticated users. If exploited, this could allow a malicious user to configure Site-Specific SAML settings and could lead to account takeover for users of that site. Tableau Server versions affected on both Windows and Linux are: 2018.2 through 2018.2.27, 2018.3 through 2018.3.24, 2019.1 through 2019.1.22, 2019.2 through 2019.2.18, 2019.3 through 2019.3.14, 2019.4 through 2019.4.13, 2020.1 through 2020.1.10, 2020.2 through 2020.2.7, and 2020.3 through 2020.3.2.

Risk Information

Base Score

9.8

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

1.355

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2020-6939 are affected in Salesforce Tableau Server 2018.2.27	Windows
Vulnerabilities CVE-2020-6939 are affected in Salesforce Tableau Server 2018.3.24	Windows
Vulnerabilities CVE-2020-6939 are affected in Salesforce Tableau Server 2019.1.22	Windows
Vulnerabilities CVE-2020-6939 are affected in Salesforce Tableau Server 2019.2.18	Windows
Vulnerabilities CVE-2020-6939 are affected in Salesforce Tableau Server 2019.3.14	Windows
Vulnerabilities CVE-2020-6939 are affected in Salesforce Tableau Server 2019.4.13	Windows
Vulnerabilities CVE-2020-6939 are affected in Salesforce Tableau Server 2020.1.10	Windows
Vulnerabilities CVE-2020-6939 are affected in Salesforce Tableau Server 2020.2.7	Windows
Vulnerabilities CVE-2020-6939 are affected in Salesforce Tableau Server 2020.3.2	Windows

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234