PT-2021-5124 · Microsoft · Power Bi Report Server

Emanuele Barbeno · Published 2021-11-09 · Updated 2026-02-24 · CVE-2021-41372

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:M/Au:N/C:C/I:P/A:N

Name of the Vulnerable Software and Affected Versions Power BI Report Server (affected versions not specified)

Description The issue is related to errors in the user interface's representation of information. It involves a Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerability that occurs when a Power BI Report Server Template file (pbix) containing HTML files is uploaded to the server and the HTML files are accessed directly by the victim. This allows an attacker to upload malicious Power BI template files to the server using the victim's session, run scripts in the security context of the user, and potentially perform privilege escalation if the victim has admin privileges. The security update addresses the issue by ensuring that Power BI Report Server properly sanitizes file uploads.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Spoofing

XSS

UI Misrepresentation of Critical Information

CSRF

Weakness Enumeration

CWE-79

CWE-451

CWE-352

Related Identifiers

BDU:2021-05917

CVE-2021-41372

Affected Products

Power Bi Report Server

References · 9

• https://osv.dev/vulnerability/CVE-2021-41372 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-41372 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41372 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41372 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05917 · Security Note
• https://t.me/cvenotify/23220 · Telegram Post
• https://t.me/cvenotify/81240 · Telegram Post
• https://t.me/cveNotify/153031 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2021110935 · Note