{"id":59822,"date":"2025-08-02T10:33:41","date_gmt":"2025-08-02T10:33:41","guid":{"rendered":""},"modified":"2025-11-01T05:38:05","modified_gmt":"2025-11-01T11:38:05","slug":"cve-2025-52453-critical-server-side-request-forgery-vulnerability-in-salesforce-tableau-server","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-52453-critical-server-side-request-forgery-vulnerability-in-salesforce-tableau-server\/","title":{"rendered":"<strong>CVE-2025-52453: Critical Server-Side Request Forgery Vulnerability in Salesforce Tableau Server<\/strong>"},"content":{"rendered":"<p><strong>Overview<\/strong><\/p>\n<p>A significant Server-Side Request Forgery (SSRF) vulnerability has been identified in Salesforce&#8217;s Tableau Server &#8211; a popular data visualization tool. With a CVSS severity score of 8.2, this vulnerability is a major concern. It affects both <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-8088-path-traversal-vulnerability-in-windows-version-of-winrar\/\"  data-wpil-monitor-id=\"78673\">Windows and Linux versions<\/a> of the server, specifically targeting the Flow Data Source modules. The implications of this <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-47998-severe-heap-based-buffer-overflow-vulnerability-in-windows-routing-and-remote-access-service\/\"  data-wpil-monitor-id=\"67680\">vulnerability are severe<\/a>, including potential system compromise or data leakage, making it a pressing concern for any organization utilizing these affected systems.<br \/>\nThe SSRF <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-7549-critical-vulnerability-in-tenda-fh1201-allows-remote-stack-based-buffer-overflow\/\"  data-wpil-monitor-id=\"67679\">vulnerability allows<\/a> an attacker to spoof the server&#8217;s resource location, which could potentially grant unauthorized access to internal resources, bypassing standard security measures. The importance of addressing this <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-7419-critical-vulnerability-discovered-in-tenda-o3v2-leading-to-potential-system-compromise\/\"  data-wpil-monitor-id=\"69327\">vulnerability cannot be overstated due to the potential<\/a> risk posed to sensitive business data.<\/p>\n<p><strong>Vulnerability Summary<\/strong><\/p>\n<p>CVE ID: CVE-2025-52453<br \/>\nSeverity: High (8.2 CVSS score)<br \/>\nAttack Vector: Network<br \/>\nPrivileges Required: None<br \/>\nUser Interaction: None<br \/>\nImpact: <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-43186-critical-memory-handling-issue-leading-to-unexpected-app-termination-and-potential-system-compromise\/\"  data-wpil-monitor-id=\"69328\">Potential system<\/a> compromise or data leakage<\/p>\n<p><strong>Affected Products<\/strong><\/p><div id=\"ameeb-4225783705\" class=\"ameeb-content-2 ameeb-entity-placement\"><div style=\"border-left: 4px solid #555; padding-left: 20px; margin: 48px 0; font-family: Roboto, sans-serif; color: #ffffff; line-height: 1.6; max-width: 700px;\">\r\n  <h2 style=\"margin-top: 0; font-size: 20px; font-weight: 600; display: flex; align-items: center;\">\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\" style=\"display: inline-flex; align-items: center; margin-right: 8px;\">\r\n      <img decoding=\"async\" src=\"https:\/\/www.ameeba.com\/blog\/wp-content\/uploads\/2025\/10\/Best-App-icon-Ameeba.png\" alt=\"Ameeba Chat Icon\" style=\"width: 40px; height: 40px;\" \/>\r\n    <\/a>\r\n    A new way to communicate\r\n  <\/h2>\r\n\r\n  <p style=\"margin-bottom: 12px;\">\r\n    Ameeba Chat is built on encrypted identity, not personal profiles.\r\n  <\/p>\r\n\r\n  <p style=\"margin-bottom: 16px;\">\r\n    Message, call, share files, and coordinate with identities kept separate.\r\n  <\/p>\r\n\r\n  <ul style=\"list-style: none; padding-left: 0; margin-bottom: 20px;\">\r\n    <li>\u2022 Encrypted identity<\/li>\r\n    <li>\u2022 Ameeba Chat authenticates access<\/li>\r\n    <li>\u2022 Aliases and categories<\/li>\r\n    <li>\u2022 End-to-end encrypted chat, calls, and files<\/li>\r\n    <li>\u2022 Secure notes for sensitive information<\/li>\r\n  <\/ul>\r\n\r\n  <p style=\"font-style: italic; font-weight: 600; margin-bottom: 24px;\">\r\n    Private communication, rethought.\r\n  <\/p>\r\n\r\n  <div style=\"display: flex; flex-wrap: wrap; gap: 12px;\">\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\/download\" style=\"background-color: #ffffff; color: #000000; padding: 10px 20px; text-decoration: none; border-radius: 6px; font-weight: 500;\">Download Ameeba Chat<\/a>\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\" style=\"border: 1px solid #ffffff; color: #ffffff; padding: 10px 20px; text-decoration: none; border-radius: 6px; font-weight: 500;\">Learn More<\/a>\r\n  <\/div>\r\n<\/div>\r\n<\/div>\n<p>Product | Affected Versions<\/p>\n<p>Tableau Server on Windows | before 2025.1.3<br \/>\nTableau Server on <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-6297-exploitation-of-dpkg-deb-extraction-vulnerability\/\"  data-wpil-monitor-id=\"91998\">Linux<\/a> | before 2025.1.3<br \/>\nTableau Server on Windows | before 2024.2.12<br \/>\nTableau Server on Linux | before 2024.2.12<br \/>\nTableau Server on Windows | before 2023.3.19<br \/>\nTableau Server on Linux | before 2023.3.19<\/p>\n<p><strong>How the Exploit Works<\/strong><\/p>\n<p>The SSRF vulnerability in <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-8243-critical-buffer-overflow-vulnerability-in-totolink-x15-http-post-request-handler\/\"  data-wpil-monitor-id=\"67681\">Salesforce Tableau<\/a> Server takes advantage of the Flow Data Source modules&#8217; ability to make requests to internal resources. An <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2024-9408-server-side-request-forgery-attack-in-eclipse-glassfish\/\"  data-wpil-monitor-id=\"77206\">attacker can craft malicious requests which masquerade as legitimate server<\/a> requests. This allows the attacker to bypass security measures and access sensitive internal resources, potentially <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-7793-critical-vulnerability-in-tenda-fh451-leading-to-system-compromise\/\"  data-wpil-monitor-id=\"68523\">leading to system<\/a> compromise or data leakage.<\/p>\n<p><strong>Conceptual Example Code<\/strong><\/p><div id=\"ameeb-1432248801\" class=\"ameeb-content ameeb-entity-placement\"><div class=\"poptin-embedded\" data-id=\"f6b387694f681\"><\/div>\r\n\r\n\r\n\r\n\r\n\r\n<\/div>\n<p>An attacker might exploit the <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-36845-server-side-request-forgery-ssrf-vulnerability-in-eveo-urve-web-manager\/\"  data-wpil-monitor-id=\"70631\">vulnerability by sending a HTTP request<\/a> similar to the following:<\/p>\n<pre><code class=\"\" data-line=\"\">GET \/flow-data-source\/module HTTP\/1.1\nHost: target.example.com\nContent-Type: application\/json\n{ &quot;resource_location&quot;: &quot;internal:\/\/sensitive-data&quot; }<\/code><\/pre>\n<p>This request would trick the server into believing that it is a legitimate request for internal resources, thus enabling the attacker to access <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-43233-critical-https-proxy-vulnerability-allowing-sensitive-data-access\/\"  data-wpil-monitor-id=\"69326\">sensitive data<\/a> or systems.<\/p>\n<p><strong>Mitigation and Prevention<\/strong><\/p>\n<p>To mitigate the <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-30403-heap-buffer-overflow-vulnerability-in-mvfst-impacts-quic-sessions\/\"  data-wpil-monitor-id=\"82336\">impact of this vulnerability<\/a>, users are advised to apply the vendor patch as soon as it is available. For immediate mitigation, <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-50738-memos-application-vulnerability-allows-for-unauthorized-user-information-disclosure\/\"  data-wpil-monitor-id=\"70632\">users can employ a Web Application<\/a> Firewall (WAF) or an Intrusion Detection System (IDS). These systems can detect and block SSRF attempts, providing temporary mitigation until the patch is installed. Regular security audits and updates can also help in preventing such <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-52950-unauthorized-access-exploitation-in-juniper-networks-security-director\/\"  data-wpil-monitor-id=\"71369\">vulnerabilities<\/a> from being exploited.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Overview A significant Server-Side Request Forgery (SSRF) vulnerability has been identified in Salesforce&#8217;s Tableau Server &#8211; a popular data visualization tool. With a CVSS severity score of 8.2, this vulnerability is a major concern. It affects both Windows and Linux versions of the server, specifically targeting the Flow Data Source modules. The implications of this [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[88,82],"product":[],"attack_vector":[101],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-59822","post","type-post","status-publish","format-standard","hentry","category-uncategorized","vendor-linux","vendor-microsoft","attack_vector-ssrf"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/59822","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/comments?post=59822"}],"version-history":[{"count":9,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/59822\/revisions"}],"predecessor-version":[{"id":85203,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/59822\/revisions\/85203"}],"wp:attachment":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/media?parent=59822"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/categories?post=59822"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/tags?post=59822"},{"taxonomy":"vendor","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/vendor?post=59822"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/product?post=59822"},{"taxonomy":"attack_vector","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/attack_vector?post=59822"},{"taxonomy":"asset_type","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/asset_type?post=59822"},{"taxonomy":"severity","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/severity?post=59822"},{"taxonomy":"exploit_status","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/exploit_status?post=59822"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}