Salesforce CVE-2025-52454

The CVSS v3.1 score of 8.2 reflects High severity driven by network-based attack vector (AV:N), changed scope (S:C), and high confidentiality and integrity impact (C:H/I:H), though attack complexity is High (AC:H) and requires low-level authentication (PR:L). Despite the elevated CVSS score, real-world exploitation risk appears limited based on EPSS probability of only 0.04% (12th percentile), indicating security researchers and threat actors have not demonstrated significant interest or exploitation activity. The requirement for authenticated access (PR:L) and high attack complexity serve as meaningful barriers to exploitation. No public exploit code exists and the vulnerability is not listed in CISA KEV, further supporting lower immediate risk. Organizations using Tableau Server with S3 connectors should prioritize patching during normal maintenance windows rather than treating this as an emergency, though the changed scope and potential for lateral movement into cloud infrastructure warrants attention for environments with sensitive data in connected S3 buckets.

An authenticated attacker with low-level Tableau Server credentials crafts a malicious data source configuration using the Amazon S3 Connector, specifying a manipulated S3 endpoint URL that redirects requests to internal cloud metadata services (such as http://169.254.169.254/latest/meta-data/) or internal network resources. When Tableau Server processes the connection request, it inadvertently retrieves sensitive credentials, configuration data, or internal system information that the attacker can then exfiltrate, potentially enabling lateral movement into the cloud infrastructure or accessing data in other S3 buckets trusted by the Tableau Server's IAM role.