« Volver al listado

CVE-2020-6938

Estado: ModificadaAlta (7.5)—

A sensitive information disclosure vulnerability in Tableau Server 10.5, 2018.x, 2019.x, 2020.x released before June 26, 2020, could allow access to sensitive information in log files.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Tableau — Tableau Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-6938",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@salesforce.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Tableau",
          "versions": [
            {
              "status": "affected",
              "version": "10.5, 2018.1, 2018.2, 2018.3, 2019.1, 2019.2, 2019.3, 2019.4, 2020.1, 2020.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-07-08T16:15:11.260",
  "references": [
    {
      "url": "https://help.salesforce.com/apex/HTViewSolution?urlname=Sensitive-information-disclosure-vulnerability-affecting-Tableau-Server-in-certain-use-cases&language=en_US",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@salesforce.com"
    },
    {
      "url": "https://help.salesforce.com/articleView?id=000354158&type=1&mode=1",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@salesforce.com"
    },
    {
      "url": "https://help.salesforce.com/apex/HTViewSolution?urlname=Sensitive-information-disclosure-vulnerability-affecting-Tableau-Server-in-certain-use-cases&language=en_US",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://help.salesforce.com/articleView?id=000354158&type=1&mode=1",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-532"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A sensitive information disclosure vulnerability in Tableau Server 10.5, 2018.x, 2019.x, 2020.x released before June 26, 2020, could allow access to sensitive information in log files."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de divulgación de información confidencial en Tableau Server versiones 10.5, 2018.x, 2019.x, 2020.x publicada antes del 26 de junio de 2020, podría permitir un acceso a información confidencial en archivos de registro"
    }
  ],
  "lastModified": "2026-06-17T03:24:00.073",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tableau:tableau_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CA634751-D358-452E-8D0B-0E303117BA84",
              "versionEndIncluding": "2020.2",
              "versionStartIncluding": "2018.1"
            },
            {
              "criteria": "cpe:2.3:a:tableau:tableau_server:10.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "66F3C9BF-5442-450A-A698-0151DAD3DDDF"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "security@salesforce.com"
}