CVE-2022-22127
Last modified
CVE-2022-22127 is a high-severity vulnerability rated 7.2/10 on the CVSS scale. Tableau is aware of a broken access control vulnerability present in Tableau Server affecting Tableau Server customers using Local Identity Store for managing users. The vulnerability allows a malicious site administrator to change passwords for users in different sites hosted on the same Tableau Server, resulting in the potential for unauthorized access to data.Tableau Server versions affected are:2020.4.16, 2021.1.13, 2021.2.10, 2021.3.9, 2021.4.4 and earlierNote: All future releases of Tableau Server will address this security issue. EPSS estimates a 0.97% chance of exploitation in the next 30 days.
Description
Tableau is aware of a broken access control vulnerability present in Tableau Server affecting Tableau Server customers using Local Identity Store for managing users. The vulnerability allows a malicious site administrator to change passwords for users in different sites hosted on the same Tableau Server, resulting in the potential for unauthorized access to data.Tableau Server versions affected are:2020.4.16, 2021.1.13, 2021.2.10, 2021.3.9, 2021.4.4 and earlierNote: All future releases of Tableau Server will address this security issue. Versions that are no longer supported are not tested and may be vulnerable.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Tableau | Tableau Server | >= 2020.4, <= 2020.4.16 |
| Tableau | Tableau Server | >= 2021.1, <= 2021.1.13 |
| Tableau | Tableau Server | >= 2021.2, <= 2021.2.10 |
| Tableau | Tableau Server | >= 2021.3, <= 2021.3.9 |
| Tableau | Tableau Server | >= 2021.4, <= 2021.4.4 |
References
- https://help.salesforce.com/s/articleView?id=000365493&type=1Third Party Advisory
- https://help.salesforce.com/s/articleView?id=000365493&type=1Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-22127?
How severe is CVE-2022-22127?
How do I fix CVE-2022-22127?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-22121In NocoDB, versions 0.81.0 through 0.83.8 are affected by CS…8
- CVE-2022-22122Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2022-22123In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable …5.4
- CVE-2022-22124In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable …5.4
- CVE-2022-22125In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable …4.8
- CVE-2022-22126Openmct versions 1.3.0 to 1.7.7 are vulnerable against store…6.1
- CVE-2022-22128Tableau discovered a path traversal vulnerability affecting …9.8
- CVE-2022-2213A vulnerability was found in SourceCodester Library Manageme…5.4
- CVE-2022-22137A memory corruption vulnerability exists in the ioca_mys_rgb…6.5
- CVE-2022-22138All versions of package fast-string-search are vulnerable to…7.5
- CVE-2022-22139Uncontrolled search path in the Intel(R) XTU software before…7.3
- CVE-2022-2214A vulnerability was found in SourceCodester Library Manageme…8.8
Are you affected by CVE-2022-22127?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST