« Volver al listado

CVE-2014-1204

Estado: ModificadaAlta (7.5)—

SQL injection vulnerability in Tableau Server 8.0.x before 8.0.7 and 8.1.x before 8.1.2 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. NOTE: this can be exploited by unauthenticated remote attackers if the guest user is enabled.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Tableausoftware — Tableau Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-1204",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-01-31T15:07:36.467",
  "references": [
    {
      "url": "http://osvdb.org/102568",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/56620",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.exploit-db.com/exploits/31578",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/65171",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securitytracker.com/id/1029706",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.tableausoftware.com/support/releases/8.0.7",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.tableausoftware.com/support/releases/812",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90730",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.trustwave.com/spiderlabs/advisories/TWSL2014-003.txt",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/102568",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/56620",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.exploit-db.com/exploits/31578",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/65171",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1029706",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.tableausoftware.com/support/releases/8.0.7",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.tableausoftware.com/support/releases/812",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90730",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.trustwave.com/spiderlabs/advisories/TWSL2014-003.txt",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SQL injection vulnerability in Tableau Server 8.0.x before 8.0.7 and 8.1.x before 8.1.2 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.  NOTE: this can be exploited by unauthenticated remote attackers if the guest user is enabled."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de inyección SQL en Tableau Server 8.0.x anterior a 8.0.7 y 8.1.x anterior a 8.1.2 permite a usuarios remotos autenticados ejecutar comandos SQL arbitrarios a través de vectores no especificados. NOTA: este problema puede ser explotado por atacantes no autenticados si el usuario invitado está habilitado."
    }
  ],
  "lastModified": "2026-06-17T00:04:31.580",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tableausoftware:tableau_server:8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BEE5F3D1-1CB3-4FBF-B948-069A3185A657"
            },
            {
              "criteria": "cpe:2.3:a:tableausoftware:tableau_server:8.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7B0E4238-6D75-492A-86B2-1E82AA255841"
            },
            {
              "criteria": "cpe:2.3:a:tableausoftware:tableau_server:8.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9133A54A-DADF-4C0E-8AE2-DB8CADA47A3C"
            },
            {
              "criteria": "cpe:2.3:a:tableausoftware:tableau_server:8.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1E7D232C-0810-4C40-8E2F-6A687F33A68D"
            },
            {
              "criteria": "cpe:2.3:a:tableausoftware:tableau_server:8.0.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E89FE47E-F122-4147-A958-0EE28C564688"
            },
            {
              "criteria": "cpe:2.3:a:tableausoftware:tableau_server:8.0.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9614D0C5-852E-4920-A395-989422E9E38F"
            },
            {
              "criteria": "cpe:2.3:a:tableausoftware:tableau_server:8.0.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2565A0CF-D181-4093-B656-B104DE889E06"
            },
            {
              "criteria": "cpe:2.3:a:tableausoftware:tableau_server:8.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8FB26326-8DE7-466A-8872-919CB2F31036"
            },
            {
              "criteria": "cpe:2.3:a:tableausoftware:tableau_server:8.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FAB38B46-DFF9-449C-842E-B890A23BE203"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}