CVE-2020-6939 Missing authorization in Tableau Server

Critical 9.8 Published 23 Nov 2020 Updated 4 Aug 2024

Unauthenticated users can modify Site-Specific SAML settings in Tableau Server, potentially leading to account takeover.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-6939?

CVE-2020-6939 is a critical missing authorization vulnerability in Tableau Server, published on 23 Nov 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Tableau Server installations configured with Site-Specific SAML that allows the APIs to be used by unauthenticated users. If exploited, this could allow a malicious user to configure Site-Specific SAML settings and could lead to account takeover for users of that site. Tableau Server versions affected on both Windows and Linux are: 2018.2 through 2018.2.27, 2018.3 through 2018.3.24, 2019.1 through 2019.1.22, 2019.2 through 2019.2.18, 2019.3 through 2019.3.14, 2019.4 through 2019.4.13, 2020.1 through 2020.1.10, 2020.2 through 2020.2.7, and 2020.3 through 2020.3.2.

Which versions are affected by CVE-2020-6939?

It affects 1 product.

Products include Tableau Tableau Server.

How do I fix CVE-2020-6939?

No fix has been published for CVE-2020-6939 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2020-6939 being exploited?

There is no known exploitation of CVE-2020-6939 in the wild and no public exploit code.

Sources

Also known as GHSA-5996-m95h-vq3m.