Summary
Impact: Spoofing. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
Security updates
1.11.8091.10468 — https://support.microsoft.com/help/5007903
Vulnerabilities 1
-
High 7.6
Power BI Report Server Spoofing Vulnerability
A Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerability exists when Power BI Report Server Template file (pbix) containing HTML files is uploaded to the server and HTML files are accessed directly by the victim. Combining these 2 vuln…
Revision history
-
#3
Corrected the Power BI Report Server version in the Security Updates table to use the public release version instead of the internal build number. This is an informational change only.
-
#2
In the Security Updates table, the following revisions have been made: 1) Added "version 1.12.7977.29537" to Power BI Server entry. 2) Added Power BI Server version 1.11.8091.10468 to the table as it is also affected by this vulnerability. 3) Added Fixed Build numbers to indicate which build contains the fix that addresses this vulnerability.
-
#1
Information published.
References
-
CVE-2021-41372 Power BI Report Server Spoofing Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-41372
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss