vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2021-41372

Power BI Report Server Spoofing Vulnerability

HIGH
7.6
CVSS Score
Published: November 10, 2021 at 12:46 AM UTC
Updated: August 19, 2026 at 05:35 PM UTC
1 product affected across 1 vendorPower BI Report Server

Using Power BI Report Server version 1.11.8091.10468 by Microsoft?

Get instant alerts when new vulnerabilities affect Power BI Report Server version 1.11.8091.10468 - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.6
Exploit prediction
EPSS 0.7%

Description

A Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerability exists when Power BI Report Server Template file (pbix) containing HTML files is uploaded to the server and HTML files are accessed directly by the victim. Combining these 2 vulnerabilities together, an attacker is able to upload malicious Power BI templates files to the server using the victim's session and run scripts in the security context of the user and perform privilege escalation in case the victim has admin privileges when the victim access one of the HTML files present in the malicious Power BI template uploaded. The security update addresses the vulnerability by helping to ensure that Power BI Report Server properly sanitize file uploads.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Power BI Report Server· Microsoft
95%
1.0.0.0 ≤ v < 1.11.8091.104681.0.0.0 ≤ v < 1.12.7977.295371.0.0.015.0.1107.165
Affected range stops below 1.11.8091.10468, so it looks safe — our inference, not a vendor statement
Affected range stops below 1.12.7977.29537, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (2)

PatchVendor Advisory
Source: [email protected]
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41372
Vendor AdvisoryPatch
Source: cverecord
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-41372

CVSS

7.6HIGHmicrosoft
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-79CWE-352

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card