Skip to content
OpenAdvisories
High MSRC-CVE-2020-1173 1 CVE

Microsoft Power BI Report Server Spoofing Vulnerability

Published May 12, 2020 · Updated Aug 19, 2026 · Revision 2

Vendor: Microsoft

Summary

Impact: Spoofing. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

What version of Power BI has this vulnerability?
The version of Power BI that contains the vulnerability is the May 2019 Release, version 1.5.7074.36177 (Build 15.0.1102.371)., The vulnerability was addressed in the September 2019 release, version 1.6.7236.4246 (Build 15.0.1102.646)., The most recent version of Power BI is the January 2020 release build is 15.0.1102.777.

Security updates
1.6.7364.4075 — https://www.microsoft.com/en-us/download/details.aspx?id=55329

Vulnerabilities 1

  • Unscored —
    CVE-2020-1173

    Microsoft Power BI Report Server Spoofing Vulnerability

    A spoofing vulnerability exists in Microsoft Power BI Report Server in the way it validates the content-type of uploaded attachments. An authenticated attacker could exploit the vulnerability by uploading a specially crafted payload and sending it to the user…

    Microsoft Power BI Report Server

Revision history

  1. #2

    Corrected the Power BI Report Server version in the Security Updates table to use the public release version instead of the internal build number. This is an informational change only.

  2. #1

    Information published.

References