CVE-2025-52455: 
Tableau Server vulnerability analysis and mitigation

CVE-2025-52455 is a Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server affecting the EPS Server modules on both Windows and Linux platforms. It allows unauthenticated remote attackers to perform Resource Location Spoofing. Affected versions include Tableau Server before 2025.1.3, before 2024.2.12, and before 2023.3.19. The vulnerability was published on July 25, 2025, and carries a CVSS v3.1 base score of 5.3 (Medium) (Salesforce Advisory, Red Hat CVE).

The vulnerability is classified as CWE-918 (Server-Side Request Forgery) and resides in the EPS (Embedded PostgreSQL Server) Server modules of Tableau Server. An unauthenticated attacker can send crafted network requests that cause the server to make HTTP or other protocol requests to arbitrary internal or external resources, enabling Resource Location Spoofing. No user interaction or elevated privileges are required, and the attack vector is network-accessible, making it exploitable remotely without authentication (Salesforce Advisory, Security Online).

Successful exploitation of this SSRF vulnerability results in limited confidentiality impact, as attackers can potentially access internal network resources or services that are otherwise inaccessible from the external network. Integrity and availability are not directly impacted. In environments where Tableau Server has access to sensitive internal APIs, metadata services (e.g., cloud instance metadata endpoints), or internal databases, the SSRF could be leveraged to enumerate internal infrastructure or facilitate further attacks (Salesforce Advisory, GBHackers).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-52455 as of the available data. The EPSS score is approximately 0.028%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

Salesforce has released patched versions of Tableau Server to address this vulnerability. Users should upgrade to version 2025.1.3 or later, 2024.2.12 or later, or 2023.3.19 or later, depending on their release branch. No specific configuration-based workarounds have been publicly documented; upgrading to a fixed version is the recommended remediation (Salesforce Advisory).

Security media outlets including GBHackers, CyberSecurityNews, and SecurityOnline covered the broader set of Tableau Server vulnerabilities patched by Salesforce in July 2025, noting that the batch included RCE, SSRF, and data exposure flaws (Security Online, GBHackers, CyberSecurityNews). Black Kite highlighted the vulnerability in their TPRM (Third-Party Risk Management) Focus Friday series, advising organizations to assess their Tableau Server exposure (Black Kite). The Hacker News also referenced the Tableau vulnerabilities in their weekly recap (The Hacker News).