CVE-2021-41372: microsoft power_bi_report_server Cross-site Scripting

Vulnerability summary

CVE-2021-41372 is a high (CVSS 7.6) Cross-site Scripting vulnerability in microsoft power_bi_report_server. EPSS estimates a 0.68% chance of exploitation in the next 30 days, higher than 51.5% of scored vulnerabilities.

Timeline

1. 10-11-2021
   PublishedVulnerability first disclosed.
2. 19-08-2026
   Last modifiedVulnerability information updated.

Description

A Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerability exists when Power BI Report Server Template file (pbix) containing HTML files is uploaded to the server and HTML files are accessed directly by the victim. Combining these 2 vulnerabilities together, an attacker is able to upload malicious Power BI templates files to the server using the victim's session and run scripts in the security context of the user and perform privilege escalation in case the victim has admin privileges when the victim access one of the HTML files present in the malicious Power BI template uploaded. The security update addresses the vulnerability by helping to ensure that Power BI Report Server properly sanitize file uploads.

• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
• CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.