Skip to main content
Public proof of concept

CVE-2019-15637

A public proof of concept exists; no exploitation attested.

  • Published2019-08-26
  • WeaknessCWE-611

Am I affected?

With a domain, we read the version its public headers and pages expose. A distribution build can carry the fix under an older number.

Description

Numerous Tableau products are vulnerable to XXE via a malicious workbook, extension, or data source, leading to information disclosure or a DoS. This affects Tableau Server, Tableau Desktop, Tableau Reader, and Tableau Public Desktop.

Timeline

dates in UTC
  1. 2019-08-27Exploit-DB entryExploit-DB

Versions per branch

NVD
Tableau tableau desktopversion to verify
BranchAffectedFixed in
10.2≥ 10.2, ≤ 10.2.23no fix published
10.3≥ 10.3, ≤ 10.3.23no fix published
10.4≥ 10.4, ≤ 10.4.19no fix published
10.5≥ 10.5, ≤ 10.5.18no fix published
2018.1≥ 2018.1, ≤ 2018.1.15no fix published
2018.2≥ 2018.2, ≤ 2018.2.12no fix published
2018.3≥ 2018.3, ≤ 2018.3.9no fix published
2019.1≥ 2019.1, ≤ 2019.1.6no fix published
2019.2≥ 2019.2, ≤ 2019.2.2no fix published
Tableau tableau serverversion to verify
BranchAffectedFixed in
10.5≥ 10.5, ≤ 10.5.18no fix published
2018.1≥ 2018.1, ≤ 2018.1.15no fix published
2018.x≥ 2018.2, ≤ 2018.12no fix published
2018.3≥ 2018.3, ≤ 2018.3.9no fix published
2019.1≥ 2019.1, ≤ 2019.1.6no fix published
2019.2≥ 2019.2, ≤ 2019.2.2no fix published
10.2≥ 10.2, ≤ 10.2.23no fix published
10.3≥ 10.3, ≤ 10.3.23no fix published
10.4≥ 10.4, ≤ 10.4.19no fix published
Tableau tableau public desktopversion to verify
BranchAffectedFixed in
10.2≥ 10.2, ≤ 10.2.2no fix published

1 more product in the sources.

as publishedRanges as NVD and OSV publish them; a distribution’s build can be fixed under an older number.

Fix

Advisories and patches

Detection

read 2026-11-04 22:56 UTC
Nuclei template
none so far
ProjectDiscovery
Exploit-DB
EDB-47308
Exploit-DB
Metasploit modules
none listed
Metasploit Framework

Sources

  • NVDCVSS 3.18.1read 2026-10-23
  • CNACVSS 3.07.1known since 2026-10-23
  • NVDCVSS 2.05.5read 2026-10-23
  • NVDweakness (CWE)CWE-611read 2026-10-23
  • FIRST EPSSEPSS score14.3 %read 2026-11-04
  • Exploit-DBdetectionread 2026-11-04

Identifiers

Technical details

CVSS v3 Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Published
2019-08-26
Last Modified
2026-06-17
NVD status
Modified

Frequently asked questions

What is CVE-2019-15637?

Numerous Tableau products are vulnerable to XXE via a malicious workbook, extension, or data source, leading to information disclosure or a DoS. This affects Tableau Server, Tableau Desktop, Tableau Reader, and Tableau Public Desktop.

Is CVE-2019-15637 actively exploited?

Active exploitation of CVE-2019-15637 has not been confirmed. Its EPSS score was 14.3% on 2026-11-04, the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2019-15637?

CVE-2019-15637 has a CVSS v3 base score of 8.1 (HIGH severity), with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H.

Hear about the next vulnerability in your software

Surveillance reads the versions in your stack — a domain, a lockfile or a list — checks each CVE against the ranges its sources publish, and alerts you when one you run is exploited or enters CISA KEV. A version it cannot read stays « version not verified ».

Get alerts for this productCISA KEV additions, November 2026Search CVEs

No credit card required · No monthly cap on website lookups · 250 API requests/month

Go further

Related vulnerabilities

Same product first, then the same vendor advisory and the same publication week.

Back to CVE Database

Sources for this record