MSRC-CVE-2024-43481 — Power BI Report Server Spoofing Vulnerability

Summary

Impact: Spoofing. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?
Any authenticated attacker could trigger this vulnerability. It does not require admin or other elevated privileges.

Security updates
1.21.9032.4573 — https://learn.microsoft.com/en-us/power-bi/report-server/changelog

Vulnerabilities 1

Medium 6.5

CVE-2024-43481

Power BI Report Server Spoofing Vulnerability

Power BI Report Server Spoofing Vulnerability

Microsoft Power BI Report Server - May 2024

Oct 8, 2024

Revision history

2026-08-19 #3
Corrected the Power BI Report Server version in the Security Updates table to use the public release version instead of the internal build number. This is an informational change only.
2024-10-10 #2
Corrected Article links in the Security Updates table. This is an informational change only.
2024-10-08 #1
Information published.

References

CVE-2024-43481 Power BI Report Server Spoofing Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43481
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss