{"id":71356,"date":"2025-09-04T22:48:54","date_gmt":"2025-09-04T22:48:54","guid":{"rendered":""},"modified":"2025-11-01T05:38:04","modified_gmt":"2025-11-01T11:38:04","slug":"cve-2025-52451-improper-input-validation-vulnerability-in-salesforce-tableau-server","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-52451-improper-input-validation-vulnerability-in-salesforce-tableau-server\/","title":{"rendered":"CVE-2025-52451: Improper Input Validation Vulnerability in Salesforce Tableau Server<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

The vulnerability, identified as CVE-2025-52451, is a serious security lapse found in Salesforce’s widely used Tableau Server software. This vulnerability, categorized as an Improper Input Validation issue, allows cyber attackers to exploit Absolute Path Traversal in the tabdoc API’s create-data-source-from-file-upload modules. This vulnerability affects a broad range of organizations and industries that depend on Tableau<\/a> Server for data visualization and business intelligence. If successfully exploited, this vulnerability could lead to system<\/a> compromise or data leakage, making it a grave threat to data integrity and security.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-52451
\nSeverity: High (CVSS Score: 8.5)
\nAttack Vector: Network
\nPrivileges Required: Low
\nUser Interaction: Required
\nImpact: System compromise and potential data<\/a> leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

Tableau Server on Windows | Versions before 2025.1.3
\nTableau Server on Linux<\/a> | Versions before 2024.2.12, before 2023.3.19<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The exploit takes advantage of an Improper Input Validation<\/a> vulnerability in the create-data-source-from-file-upload module of the tabdoc API, present in Salesforce’s Tableau Server software. By sending maliciously crafted data to the module, an attacker can manipulate the data validation process and trigger an Absolute Path Traversal vulnerability<\/a>. This allows the attacker to access, modify, or delete sensitive data outside of the designated boundaries, potentially leading to system compromise or data<\/a> leakage.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

In a hypothetical scenario, the exploit might be used as follows:<\/p>\n

POST \/tabdocapi\/create-data-source-from-file-upload HTTP\/1.1\nHost: target.example.com\nContent-Type: application\/json\n{ \"file_path\": \"\/..\/..\/..\/..\/etc\/passwd\" }<\/code><\/pre>\n
In this conceptual example, the attacker sends a POST request to the vulnerable<\/a> endpoint with a malicious `file_path`. The path includes directory traversal characters (`..`), manipulating the software into accessing files<\/a> outside of the intended directory. In this case, the attacker attempts to access the `\/etc\/passwd` file, which stores user account information in Unix-based systems, potentially leading<\/a> to unauthorized access and data leakage.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview The vulnerability, identified as CVE-2025-52451, is a serious security lapse found in Salesforce’s widely used Tableau Server software. This vulnerability, categorized as an Improper Input Validation issue, allows cyber attackers to exploit Absolute Path Traversal in the tabdoc API’s create-data-source-from-file-upload modules. This vulnerability affects a broad range of organizations and industries that depend on […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[88,82],"product":[],"attack_vector":[85],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-71356","post","type-post","status-publish","format-standard","hentry","category-uncategorized","vendor-linux","vendor-microsoft","attack_vector-directory-traversal"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t