TI-2020-01137 Aliases CVE-2020-1173 GHSA-42v9-rj5j-m2v5

Microsoft Power BI Report Server Spoofing Vulnerability

LOW 35CWE-20Published 2020-05-21 · Updated 2026-08-19

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Spoofing
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from Microsoft.

Summary

A spoofing vulnerability exists in Microsoft Power BI Report Server in the way it validates the content-type of uploaded attachments. An authenticated attacker could exploit the vulnerability by uploading a specially crafted payload and sending it to the user. The attacker who successfully exploited this vulnerability could then perform actions and run scripts in the security context of the user. This security update addresses the vulnerability by ensuring Power BI Report Server properly validates content-type of the attachments when uploading and opening.

Why it matters now

EPSS 0.02482 84th percentileScored 2026-11-07

Fix Fixed Power BI Report Server (Microsoft): 1.6.7364.4075

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Microsoft	Power BI Report Server	1.6.0 to before 1.6.7364.4075	1.6.7364.4075	Patch available	CNA

Power BI Report Server VendorMicrosoft Affected 1.6.0 to before 1.6.7364.4075 Fixed in 1.6.7364.4075 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:microsoft:power_bi_report_server:-:::::::*	not specified by NVD	Vulnerable	Microsoft

cpe:2.3:a:microsoft:power_bi_report_server:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft

Remediation

Fix · CNA Power BI Report Server (Microsoft) Fixed in 1.6.7364.4075

Vendor assessments

Microsoft

Microsoft's page for this CVE →

Impact: Spoofing
Exploited: No
Publicly disclosed: No
Exploitability: Exploitation Less Likely

Product	Status	Plan or fix
Power BI Report Server	Fixed	1.6.7364.4075 · Security Update

Timeline

2026-10-02 Threatist record created from CVE-2020-1173
2026-10-03 Alias added: GHSA-42v9-rj5j-m2v5

References

Patch 2

TI-2026-46897 Power BI Remote Code Execution Vulnerability CVSS 3.1HIGH 8.8
TI-2026-17140 Power BI Remote Code Execution Vulnerability CVSS 3.1HIGH 8.8
TI-2024-29123 Power BI Report Server Spoofing Vulnerability CVSS 3.1HIGH 8.8
TI-2021-18191 Power BI Report Server Spoofing Vulnerability CVSS 3.1CRITICAL 9.6
TI-2021-11970 Power BI Remote Code Execution Vulnerability CVSS 3.1HIGH 8.8
TI-2021-08468 Microsoft Power BI Information Disclosure Vulnerability CVSS 3.1HIGH 7.7

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences