What’s Vulnerable › Vulnerabilities

CVE-2021-1629

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-03-26 · updated 2026-06-17
• Weakness: CWE-601

Description

Tableau Server fails to validate certain URLs that are embedded in emails sent to Tableau Server users.

Affected products

• Salesforce Tableau Server: from 2019.4 before 2019.4.18; from 2020.1 before 2020.1.15; from 2020.2 before 2020.2.12; from 2020.3 before 2020.3.7; from 2020.4 before 2020.4.3 — fixed in 2019.4.18, 2020.1.15, 2020.2.12, 2020.3.7, 2020.4.3

How to fix

Upgrade to a fixed version: Salesforce Tableau Server 2019.4.18, 2020.1.15, 2020.2.12, 2020.3.7. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/162138/Tableau-Server-Open-Redirection.html
• http://seclists.org/fulldisclosure/2021/Apr/22
• https://help.salesforce.com/articleView?id=000357424&type=1&mode=1
• http://packetstormsecurity.com/files/162138/Tableau-Server-Open-Redirection.html
• http://seclists.org/fulldisclosure/2021/Apr/22
• https://help.salesforce.com/articleView?id=000357424&type=1&mode=1

Get alerted when CVE-2021-1629 or the next vulnerability affects your stack