Salesforce Tableau Server Server-Side Request Forgery Vulnerability Allowing Authentication Bypass

A server-side request forgery (SSRF) vulnerability has been identified in Salesforce Tableau Server, specifically in versions 2023.3 through 2023.3.5. This vulnerability allows authentication bypass, enabling a malicious actor with access to the Tableau Server instance to authenticate and potentially access unauthenticated data on the server's network.

Impact

Exploitation of this vulnerability could lead to unauthorized access to data on the Tableau Server network that does not require authentication.

Remediation

Tableau has released versions 2023.1.4, 2022.3.8, 2022.1.16, 2021.4.20, and 2021.3.25 to address this vulnerability. These versions are available for download on the Tableau Server Maintenance Release page.