CVE-2019-19719

published 2019-12-11

CVE-2019-19719: Tableau Server 10.3 through 2019.4 on Windows and Linux allows XSS via the embeddedAuthRedirect page.

Priority P3 37 medium 6.1 CVSS 3.1

AV N AC L PR N UI R S C C L I L A N

Tableau Server 10.3 through 2019.4 on Windows and Linux allows XSS via the embeddedAuthRedirect page.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
tableau	tableau_server	10.3 – 2019.4	—

Detection & IOCs extracted from sources · hover to see the quote

url https://dataviz.mozilla.org/en/embeddedAuthRedirect.html?auth=javascript:alert(document.domain)↗

path /en/embeddedAuthRedirect.html↗

• → Monitor HTTP requests to the embeddedAuthRedirect page with an `auth` parameter containing a javascript: URI scheme, which is the attack vector for this XSS vulnerability. ↗
• → Tableau Server instances on Windows and Linux running versions 10.3 through 2019.4 are vulnerable; look for unpatched instances (fixed in 2019.2.6+ and 2019.4.1+). ↗
• → The vulnerability is being actively scanned for publicly; high volume of duplicate reports indicates automated scanning activity targeting the embeddedAuthRedirect endpoint. ↗

• · The XSS is triggered via the `auth` query parameter on the embeddedAuthRedirect page; the javascript: URI payload is reflected/executed client-side. ↗
• · Tableau's own advisory categorizes this as an open redirect (not purely XSS), so detection rules should cover both javascript: URI XSS and open redirect abuse via the same `auth` parameter. ↗

CVSS provenance

nvd v3.1 6.1 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

nvd v2.0 4.3 MEDIUM AV:N/AC:M/Au:N/C:N/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79