Skip to main content

Power Bi Report Server CVE-2023-21806

HIGH
Cross-site Scripting (XSS) (CWE-79)
2023-02-14 secure@microsoft.com
XSS Microsoft Power Bi Report Server
8.2
CVSS 3.1 · Vendor: microsoft
Share

Severity by source

Vendor (microsoft) PRIMARY
8.2 HIGH
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L

Primary rating from Vendor (microsoft) · only source for this CVE.

CVSS VectorVendor: microsoft

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
Low
Availability
Low

Lifecycle Timeline

1
CVE Published
Feb 14, 2023 - 20:15 cve.org
HIGH 8.2

DescriptionCVE.org

Power BI Report Server Spoofing Vulnerability

AnalysisAI

Power BI Report Server Spoofing Vulnerability. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

Technical ContextAI

This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. Affected products include: Microsoft Power Bi Report Server.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.

More in Power Bi Report Server

View all
CVE-2019-1332 MEDIUM POC
6.1 Dec 10

A cross-site scripting (XSS) vulnerability exists when Microsoft SQL Server Reporting Services (SSRS) does not properly

CVE-2024-43481 HIGH
8.8 Oct 08

Power BI Report Server Spoofing Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitabl
CVE-2026-65811 HIGH
8.8 Aug 11

Remote code execution in Microsoft Power BI enables low-privileged authenticated attackers to execute arbitrary code ove
CVE-2026-21229 HIGH
8.8 Feb 10

Remote code execution in Microsoft Power BI Report Server exposes organizations to full system compromise via crafted ne
CVE-2021-26859 HIGH
7.7 Mar 11

Microsoft Power BI Information Disclosure Vulnerability. Rated high severity (CVSS 7.7), this vulnerability is remotely

CVE-2021-31984 HIGH
7.6 Jul 14

Power BI Remote Code Execution Vulnerability. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable
CVE-2021-41372 HIGH
7.6 Nov 10

A Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerability exists when Power BI Report Server Temp
CVE-2020-1173 MEDIUM
6.8 May 21

A spoofing vulnerability exists in Microsoft Power BI Report Server in the way it validates the content-type of uploaded
CVE-2026-58647 MEDIUM
5.4 Jul 14

Cross-site scripting (CWE-79) in Microsoft Power BI Report Server lets an authenticated, low-privileged attacker inject

CVE-2024-43612 MEDIUM
4.7 Oct 08

Power BI Report Server Spoofing Vulnerability. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploita

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Share

CVE-2023-21806 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy