Security readout for executives and security teams
Plain-English summary
CVE-2019-19719 affects Tableau Server 10.3 through 2019.4 on Windows and Linux. The source bundle describes a cross-site scripting issue in the embeddedAuthRedirect page. Business impact depends on whether exposed users can be lured into unsafe browser interactions. No active exploitation is cited.
Executive priority
Treat as a timely remediation item for affected Tableau Server deployments, not an emergency based on this evidence alone. The lack of CVSS and exploitation evidence lowers certainty, but Tableau often holds sensitive business data.
Technical view
The record identifies Tableau Server versions 10.3 through 2019.4 on Windows and Linux as affected. The stated issue is XSS via embeddedAuthRedirect, while the vendor reference title mentions an open redirect on that page. No CVSS, CWE, exploit status, or fixed version is included in the provided bundle.
Likely exposure
Organizations running Tableau Server 10.3 through 2019.4 are potentially exposed, especially where users access Tableau through browsers and embedded authentication workflows are reachable.
Exploitation context
The provided sources do not show CISA KEV listing or active exploitation. The likely risk pattern is browser-mediated user impact, but the bundle lacks technical detail to confirm prerequisites, attacker position, or exploit reliability.
Researcher notes
Evidence is sparse. The CVE description says XSS, while the referenced Tableau bulletin title says open redirect. Do not assume exploitability, affected configurations, or fixed versions beyond the provided sources.
Mitigation direction
- Identify all Tableau Server instances and versions.
- Check Tableau's advisory for fixed releases or vendor-recommended actions.
- Prioritize upgrades for versions 10.3 through 2019.4.
- Limit exposure of Tableau interfaces where business operations permit.
- Monitor Tableau and perimeter logs for suspicious embeddedAuthRedirect activity.
Validation and detection
- Confirm Tableau Server version and operating system on each instance.
- Determine whether embeddedAuthRedirect is reachable by intended user groups.
- Review vendor advisory details before assigning final remediation scope.
- Check vulnerability management records for CVE-2019-19719 coverage.
- Verify no internet-facing Tableau instance remains on affected versions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2019-19719 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://community.tableau.com/community/security-bulletins/blog/2019/11/19/important-adv-2019-047-open-redirect-on-embeddedauthredirect-pageCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.