Tableau Server 2023.3.x < 2023.3.19 / 2024.2.x < 2024.2.12 / 2025.1.x < 2025.1.3 Multiple Vulnerabilities (005105043)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(243182);
  script_version("1.5");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/21");

  script_cve_id(
    "CVE-2025-26496",
    "CVE-2025-26497",
    "CVE-2025-26498",
    "CVE-2025-52446",
    "CVE-2025-52447",
    "CVE-2025-52448",
    "CVE-2025-52449",
    "CVE-2025-52450",
    "CVE-2025-52451",
    "CVE-2025-52452",
    "CVE-2025-52453",
    "CVE-2025-52454",
    "CVE-2025-52455"
  );
  script_xref(name:"IAVB", value:"2025-B-0152");
  script_xref(name:"IAVB", value:"2025-B-0125-S");

  script_name(english:"Tableau Server 2023.3.x < 2023.3.19 / 2024.2.x < 2024.2.12 / 2025.1.x < 2025.1.3 Multiple Vulnerabilities (005105043)");

  script_set_attribute(attribute:"synopsis", value:
"A Tableau Server instance installed on the remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Tableau Server installed on the remote host is prior to 2023.3.19, 2024.2.12 and 2025.1.3. It is, 
therefore, affected by multiple vulnerabilities as referenced in the 005105043 and 005132575 advisories, including:

    - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in 
      Salesforce Tableau Server on Windows, Linux (tabdoc api - duplicate-data-source modules) allows 
      Absolute Path Traversal. (CVE-2025-52452)

    - Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux 
      (Flow Data Source modules) allows Resource Location Spoofing. (CVE-2025-52453)

    - Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux 
      (Amazon S3 Connector modules) allows Resource Location Spoofing. (CVE-2025-52454)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://help.salesforce.com/s/articleView?id=005105043&type=1");
  script_set_attribute(attribute:"see_also", value:"https://help.salesforce.com/s/articleView?id=005132575&type=1");
  script_set_attribute(attribute:"solution", value:
"Upgrade Tableau Server to 2023.3.19, 2024.2.12, 2025.1.3 or later");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:S/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-52452");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/07/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/07/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/07/30");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:tableau:tableau_server");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tableau_server_web_detect.nbin");
  script_require_keys("installed_sw/Tableau Server");

  exit(0);
}

include('vcf.inc');

var app_info = vcf::combined_get_app_info(app:'Tableau Server');

var constraints = [
  { 'min_version' : '2023.3',    'fixed_version' : '2023.3.19' },
  { 'min_version' : '2024.2',    'fixed_version' : '2024.2.12' },
  { 'min_version' : '2025.1',    'fixed_version' : '2025.1.3' }
];

vcf::check_version_and_report(
  app_info:app_info,
  constraints:constraints,
  severity:SECURITY_HOLE
);