High severity · published May 25, 2022
CVE-2022-22127
Tableau is aware of a broken access control vulnerability present in Tableau Server affecting Tableau Server customers using Local Identity Store for managing users
7.2
CVSS
1.1%
EPSS
No
On KEV
Description
Tableau is aware of a broken access control vulnerability present in Tableau Server affecting Tableau Server customers using Local Identity Store for managing users. The vulnerability allows a malicious site administrator to change passwords for users in different sites hosted on the same Tableau Server, resulting in the potential for unauthorized access to data.Tableau Server versions affected are:2020.4.16, 2021.1.13, 2021.2.10, 2021.3.9, 2021.4.4 and earlierNote: All future releases of Tableau Server will address this security issue. Versions that are no longer supported are not tested and may be vulnerable.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TS
Tableau Server ·
2020.4.16, 2021.1.13, 2021.2.10, 2021.3.9, 2021.4.4 and earlier · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-22127
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-22127
Third Party Advisory
https://help.salesforce.com/s/articleView?id=000365493&type=1
More from Tableau Server
9.8
CVE-2022-22128
Tableau discovered a path traversal vulnerability affecting Tableau Server Administration Agent’s internal file transfer service that could allow remote code execution.Tableau…