Power BI Report Server Spoofing Vulnerability (Microsoft Power BI Report Server version 1.11.8091.10468)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.68 % · percentile 52 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- microsoft
- NVD status
- Modified
Description
A Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerability exists when Power BI Report Server Template file (pbix) containing HTML files is uploaded to the server and HTML files are accessed directly by the victim. Combining these 2 vulnerabilities together, an attacker is able to upload malicious Power BI templates files to the server using the victim's session and run scripts in the security context of the user and perform privilege escalation in case the victim has admin privileges when the victim access one of the HTML files present in the malicious Power BI template uploaded. The security update addresses the vulnerability by helping to ensure that Power BI Report Server properly sanitize file uploads.
Weaknesses (CWE)
- CWE-79 — Improper Neutralization of Input During Web Page Generation
- CWE-352 — Cross-Site Request Forgery
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N/E:P/RL:O/RC:C | microsoft |
| CVSS 3.1 | HIGH 7.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N | NVD · secure@microsoft.com (Secondary) |
| CVSS 3.1 | CRITICAL 9.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H | NVD · nvd@nist.gov (Secondary) |
| CVSS 2.0 | MEDIUM 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2021-28400
- GCVE · GCVE-0-2021-41372
CERT-FR advisories
- CERTFR-2021-AVI-863 — Multiples vulnérabilités dans les produits Microsoft · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:microsoft:power_bi_report_server:15.0.1107.165:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Microsoft · Power BI Report Server version 1.11.8091.10468 | affected 1.0.0.0 < 1.11.8091.10468 |
| Microsoft · Power BI Report Server version 1.12.7977.29537 | affected 1.0.0.0 < 1.12.7977.29537 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |