What’s Vulnerable › Vulnerabilities

CVE-2019-15637

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 14.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-08-26 · updated 2026-06-17
• Weakness: CWE-611

Description

Numerous Tableau products are vulnerable to XXE via a malicious workbook, extension, or data source, leading to information disclosure or a DoS. This affects Tableau Server, Tableau Desktop, Tableau Reader, and Tableau Public Desktop.

Affected products

• Tableau Desktop: from 10.2 through 10.2.23; from 10.3 through 10.3.23; from 10.4 through 10.4.19; from 10.5 through 10.5.18; from 2018.1 through 2018.1.15; from 2018.2 through 2018.2.12
• Tableau Public Desktop: from 10.2 through 10.2.2
• Tableau Reader: from 10.2 through 10.2.2
• Salesforce Tableau Server: from 10.5 through 10.5.18; from 2018.1 through 2018.1.15; from 2018.2 through 2018.12; from 2018.3 through 2018.3.9; from 2019.1 through 2019.1.6; from 2019.2 through 2019.2.2

References

• https://community.tableau.com/community/security-bulletins/blog/2019/08/22/important-adv-2019-030-xxe-vulnerability-in-tableau-products
• https://github.com/minecrater/exploits/blob/master/TableauXXE.py
• https://packetstormsecurity.com/files/154232/Tableau-XML-Injection.html
• https://community.tableau.com/community/security-bulletins/blog/2019/08/22/important-adv-2019-030-xxe-vulnerability-in-tableau-products
• https://github.com/minecrater/exploits/blob/master/TableauXXE.py
• https://packetstormsecurity.com/files/154232/Tableau-XML-Injection.html

Get alerted when CVE-2019-15637 or the next vulnerability affects your stack