CVE-2019-15637

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Numerous Tableau products are vulnerable to XXE via a malicious workbook, extension, or data source, leading to information disclosure or a DoS. This affects Tableau Server, Tableau Desktop, Tableau Reader, and Tableau Public Desktop.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://community.tableau.com/community/security-bulletins/blog/2019/08/22/important-adv-2019-030-xxe-vulnerability-in-tableau-productsVendor Advisory
https://github.com/minecrater/exploits/blob/master/TableauXXE.pyExploit, Third Party Advisory
https://packetstormsecurity.com/files/154232/Tableau-XML-Injection.htmlExploit, Third Party Advisory, VDB Entry
https://community.tableau.com/community/security-bulletins/blog/2019/08/22/important-adv-2019-030-xxe-vulnerability-in-tableau-productsVendor Advisory
https://github.com/minecrater/exploits/blob/master/TableauXXE.pyExploit, Third Party Advisory
https://packetstormsecurity.com/files/154232/Tableau-XML-Injection.htmlExploit, Third Party Advisory, VDB Entry

Timeline

Published: Aug 26, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-156387.8COPA-DATA zenone32 zenon Editor through 8.10 has an Uncontrolled Search Path Element.CVE-2019-156397.5main/translate.c in Sangoma Asterisk 13.28.0 and 16.5.0 allows a remote attacker to send a specific RTP packet during a call and cause a cra CVE-2019-156407.5Limesurvey before 3.17.10 does not validate both the MIME type and file extension of an image.CVE-2019-156416.5xmlrpc.cgi in Webmin through 1.930 allows authenticated XXE attacks. By default, only root, admin, and sysadm can access xmlrpc.cgi.CVE-2019-156428.8rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialise_variable makes an e CVE-2019-156436.1The ultimate-faqs plugin before 1.8.22 for WordPress has XSS.CVE-2019-156446.1The zoho-salesiq plugin before 1.0.9 for WordPress has stored XSS.CVE-2019-156458.8The zoho-salesiq plugin before 1.0.9 for WordPress has CSRF.CVE-2019-156469.8The rsvpmaker plugin before 6.2 for WordPress has SQL injection.CVE-2019-156478.8The groundhogg plugin before 1.3.5 for WordPress has wp-admin/admin-ajax.php?action=bulk_action_listener remote code execution.CVE-2019-156486.5The insert-or-embed-articulate-content-into-wordpress plugin before 4.29991 for WordPress has insufficient restrictions on deleting or renam CVE-2019-156498.8The insert-or-embed-articulate-content-into-wordpress plugin before 4.2999 for WordPress has insufficient restrictions on file upload.