Vulnerability · Published May 21, 2020 · Assigned by microsoft

CVE-2020-1173Microsoft Power BI Report Server Spoofing Vulnerability

Medium 6.8

In plain English

A medium-severity security flaw in Power BI Report Server from Microsoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 85% of all known vulnerabilities).

Severity (CVSS NVD)6.8Medium

Exploit odds (30 days)2.5%top 15.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A spoofing vulnerability exists in Microsoft Power BI Report Server in the way it validates the content-type of uploaded attachments. An authenticated attacker could exploit the vulnerability by uploading a specially crafted payload and sending it to the user. The attacker who successfully exploited this vulnerability could then perform actions and run scripts in the security context of the user. This security update addresses the vulnerability by ensuring Power BI Report Server properly validates content-type of the attachments when uploading and opening.

Affected products (as reported)

Vendor	Product	Versions
Microsoft	Power BI Report Server	1.6.0 – before 1.6.7364.4075

References

Microsoft Power BI Report Server Spoofing Vulnerability vendor-advisory, patch
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1173 x_refsource_MISC, x_transferred