What is CVE-2021-41372?

CVE-2021-41372 is a high-severity vulnerability in Microsoft Power_bi_report_server, classified under Cross-site Scripting. CVSS score: 7.6/10. Published 2021-11-10.

How severe is CVE-2021-41372?

High severity. CVSS v3 base score is 7.6 out of 10.

XSS in Microsoft Power_bi_report_server

CVE-2021-41372

A Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerability exists when Power BI Report Server Template file (pbix) containing HTML files is uploaded to the server and HTML files are accessed directly by the victim. Co…

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.006 (45.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N.

Affected products

Microsoft Power_bi_report_server — versions 15.0.1107.165
Microsoft Power Bi Report Server Version 1.11.8091.10468 — versions 1.0.0.0
Microsoft Power Bi Report Server Version 1.12.7977.29537 — versions 1.0.0.0

Weakness classification (CWE)

References

secure@microsoft.com (Patch, x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2021-41372?: CVE-2021-41372 is a high-severity vulnerability in Microsoft Power_bi_report_server, classified under Cross-site Scripting. CVSS score: 7.6/10. Published 2021-11-10.
How severe is CVE-2021-41372?: High severity. CVSS v3 base score is 7.6 out of 10.