PT-2020-2484 · Microsoft · Power Bi Report Server

Published 2020-05-12 · Updated 2020-05-27 · CVE-2020-1173

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Power BI Report Server (affected versions not specified)

Description The issue is related to errors in the representation of information by the user interface. It allows a remote attacker to conduct spoofing attacks. The vulnerability exists in the way Microsoft Power BI Report Server validates the content-type of uploaded attachments.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

UI Misrepresentation of Critical Information

RCE

Weakness Enumeration

CWE-451

CWE-20

Related Identifiers

BDU:2020-02495

CVE-2020-1173

Affected Products

Power Bi Report Server

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-1173 · Security Note
• https://bdu.fstec.ru/vul/2020-02495 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1173 · Vendor Advisory
• https://t.me/cvenotify/4002 · Telegram Post