CVE-2020-1173
Microsoft Power BI Report Server Spoofing Vulnerability
A spoofing vulnerability exists in Microsoft Power BI Report Server in the way it validates the content-type of uploaded attachments. An authenticated attacker could exploit the vulnerability by uploading a specially crafted payload and sending it to the user. The attacker who successfully exploited this vulnerability could then perform actions and run scripts in the security context of the user. This security update addresses the vulnerability by ensuring Power BI Report Server properly validates content-type of the attachments when uploading and opening.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A spoofing vulnerability exists in Microsoft Power BI Report Server in the way it validates the content-type of uploaded attachments. An authenticated attacker could exploit the vulnerability by uploading a specially crafted payload and sending it to the user. The attacker who successfully exploited this vulnerability could then perform actions and run scripts in the security context of the user. This security update addresses the vulnerability by ensuring Power BI Report Server properly validates content-type of the attachments when uploading and opening.
- Record
CVE-2020-1173- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
Microsoft Power BI Report Server Spoofing Vulnerability
A spoofing vulnerability exists in Microsoft Power BI Report Server in the way it validates the content-type of uploaded attachments. An authenticated attacker could exploit the vulnerability by uploading a specially crafted payload and sending it to the user. The attacker who successfully exploited this vulnerability could then perform actions and run scripts in the security context of the user. This security update addresses the vulnerability by ensuring Power BI Report Server properly validates content-type of the attachments when uploading and opening.
- Record
CVE-2020-1173- Updated
- 2026-11-02
EUVDEUVD-2020-12054 No score
A spoofing vulnerability exists in Microsoft Power BI Report Server in the way it validates the content-type of uploaded attachments. An authenticated attacker could exploit the vulnerability by uploading a specially crafted payload and sending it to the user. The attacker who successfully exploited this vulnerability could then perform actions and run scripts in the security context of the user. This security update addresses the vulnerability by ensuring Power BI Report Server properly validates content-type of the attachments when uploading and opening.
- Record
EUVD-2020-12054- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-42v9-rj5j-m2v5
A spoofing vulnerability exists in Microsoft Power BI Report Server in the way it validates the...
A spoofing vulnerability exists in Microsoft Power BI Report Server in the way it validates the content-type of uploaded attachments, aka 'Microsoft Power BI Report Server Spoofing Vulnerability'.
- Record
GHSA-42v9-rj5j-m2v5- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-1173 is a medium vulnerability (CVSS 6.8) in Microsoft Power Bi Report Server, published May 21, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.48%, the 84th percentile. No source names a fixed version.