CVE-2022-22127

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Tableau is aware of a broken access control vulnerability present in Tableau Server affecting Tableau Server customers using Local Identity Store for managing users. The vulnerability allows a malicious site administrator to change passwords for users in different sites hosted on the same Tableau Server, resulting in the potential for unauthorized access to data.Tableau Server versions affected are:2020.4.16, 2021.1.13, 2021.2.10, 2021.3.9, 2021.4.4 and earlierNote: All future releases of Tableau Server will address this security issue. Versions that are no longer supported are not tested and may be vulnerable.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: May 25, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-221289.8Tableau discovered a path traversal vulnerability affecting Tableau Server Administration Agent’s internal file transfer service that could CVE-2022-22135.4A vulnerability was found in SourceCodester Library Management System 1.0. It has been declared as problematic. Affected by this vulnerabili CVE-2022-221376.5A memory corruption vulnerability exists in the ioca_mys_rgb_allocate functionality of Accusoft ImageGear 19.10. A specially-crafted malform CVE-2022-221387.5All versions of package fast-string-search are vulnerable to Denial of Service (DoS) when computations are incorrect for non-string inputs. CVE-2022-221397.3Uncontrolled search path in the Intel(R) XTU software before version 7.3.0.33 may allow an authenticated user to potentially enable escalati CVE-2022-22148.8A vulnerability was found in SourceCodester Library Management System 1.0. It has been rated as critical. Affected by this issue is some unk CVE-2022-221409.8An os command injection vulnerability exists in the confsrv ucloud_add_node functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A spec CVE-2022-221417.8'Long-term Data Archive Package' service implemented in the following Yokogawa Electric products creates some named pipe with imporper ACL c CVE-2022-221426.1Reflected cross-site scripting vulnerability in the checkbox of php_mailform versions prior to Version 1.40 allows a remote unauthenticated CVE-2022-221439.8The package convict before 6.2.2 are vulnerable to Prototype Pollution via the convict function due to missing validation of parentKey. **No CVE-2022-221449.8A hard-coded password vulnerability exists in the libcommonprod.so prod_change_root_passwd functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_0 CVE-2022-221458.1CAMS for HIS Log Server contained in the following Yokogawa Electric products is vulnerable to uncontrolled resource consumption. CENTUM CS