Vulners
Lucene search
Tableau Server - Blind SQL Injection Vulnerability
| Reporter | Title | Published | Views | Family All 11 |
|---|---|---|---|---|
 | CVE-2014-1204 | 11 Feb 201400:00 | – | circl |
 | CVE-2014-1204 | 31 Jan 201415:00 | – | cve |
 | CVE-2014-1204 | 31 Jan 201415:00 | – | cvelist |
 | Tableau Server < 8.0.7 / < 8.1.2 - Blind SQL Injection | 11 Feb 201400:00 | – | exploitdb |
 | EUVD-2014-1285 | 7 Oct 202500:30 | – | euvd |
 | Tableau Server 8.0.7 8.1.2 - Blind SQL Injection | 11 Feb 201400:00 | – | exploitpack |
 | CVE-2014-1204 | 31 Jan 201415:07 | – | nvd |
 | Tableau Server 8.0.x < 8.0.7, 8.1.x < 8.1.2 Unspecified SQLi Vulnerability | 9 Nov 201500:00 | – | openvas |
 | Tableau Server Blind SQL Injection | 11 Feb 201400:00 | – | packetstorm |
 | Sql injection | 31 Jan 201415:07 | – | prion |
10
Blind SQL Injection Vulnerability in Tableau Server
Published: 02/07/14
Version: 1.1
Vendor: Tableau Software (http://www.tableausoftware.com)
Product: Tableau Server
Versions affected: 8.1.X before 8.1.2 and 8.0.X before 8.0.7. Not present
in 7.0.X and earlier.
Product description:
Tableau Server is a business intelligence application that provides
browser-based analytics.
Finding: Blind SQL Injection
Credit: Tanya Secker & Christiaan Esterhuizen of Trustwave SpiderLabs
CVE: CVE-2014-1204
CWE: CWE-89
It is possible for an authenticated user or guest user (if enabled) to
inject arbitrary SQL into the Tableau Server backend database. As a
proof of concept the default database user (Zrails) was retrieved using the
following payload:
http://127.0.0.1/views?modified_after=2013-12-08T23%3A00%3A00.000Z'%20or%20user%20like%20'Zrails
The database appears to be Oracle and both the modified_after and
modified_before parameters are vulnerable.
Remediation Steps:
The vendor has released a fix in version 8.1.2 and version 8.0.7. Version
7.0.X is not affected.
Revision History:
12/06/13 - Vulnerability disclosed
12/06/13 - Vendor responded
12/23/13 - Patch released by vendor
01/24/14 - Advisory published
02/07/14 - Advisory revision published
# 0day.today [2018-04-14] #Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
11 Feb 2014 00:00Current
0.1Low risk
Vulners AI Score0.1
EPSS0.02325