CVE-2020-6938

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A sensitive information disclosure vulnerability in Tableau Server 10.5, 2018.x, 2019.x, 2020.x released before June 26, 2020, could allow access to sensitive information in log files.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-532

Affected software

Vendor	Product	Versions
n/a	Tableau	10.5, 2018.1, 2018.2, 2018.3, 2019.1, 2019.2, 2019.3, 2019.4, 2020.1, 2020.2

References

https://help.salesforce.com/apex/HTViewSolution?urlname=Sensitive-information-disclosure-vulnerability-affecting-Tableau-Server-in-certain-use-cases&language=en_USThird Party Advisory
https://help.salesforce.com/articleView?id=000354158&type=1&mode=1Third Party Advisory
https://help.salesforce.com/apex/HTViewSolution?urlname=Sensitive-information-disclosure-vulnerability-affecting-Tableau-Server-in-certain-use-cases&language=en_USThird Party Advisory
https://help.salesforce.com/articleView?id=000354158&type=1&mode=1Third Party Advisory

Timeline

Published: Jul 8, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-69399.8Tableau Server installations configured with Site-Specific SAML that allows the APIs to be used by unauthenticated users. If exploited, this CVE-2020-69489.8A remote code execution issue was discovered in HashBrown CMS through 1.3.3. Server/Entity/Deployer/GitDeployer.js has a Service.AppService.CVE-2020-69498.8A privilege escalation issue was discovered in the postUser function in HashBrown CMS through 1.3.3. An editor user can change the password CVE-2020-69506.5Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter.CVE-2020-69546.5An issue was discovered on Cayin SMP-PRO4 devices. A user can discover a saved password by viewing the URL after a Connection String Test. T CVE-2020-69556.1An issue was discovered on Cayin SMP-PRO4 devices. They allow image_preview.html?filename= reflected XSS.CVE-2020-69566.1PCS DEXICON 3.4.1 allows XSS via the loginName parameter in login_action.jsp.CVE-2020-69589.1An XXE vulnerability in JnlpSupport in Yet Another Java Service Wrapper (YAJSW) 12.14, as used in NSA Ghidra and other products, allows atta CVE-2020-69599.8The following versions of MAXPRO VMS and NVR, MAXPRO VMS:HNMSWVMS prior to Version VMS560 Build 595 T2-Patch, HNMSWVMSLT prior to Version VM CVE-2020-69609.8The following versions of MAXPRO VMS and NVR, MAXPRO VMS:HNMSWVMS prior to Version VMS560 Build 595 T2-Patch, HNMSWVMSLT prior to Version VM CVE-2020-696110.0In ApexPro Telemetry Server, Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X CVE-2020-696210.0In ApexPro Telemetry Server, Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X