CVE-2020-1173

MediumCVSS 6.8/10Last modified Aug 19, 2026

Description

A spoofing vulnerability exists in Microsoft Power BI Report Server in the way it validates the content-type of uploaded attachments. An authenticated attacker could exploit the vulnerability by uploading a specially crafted payload and sending it to the user. The attacker who successfully exploited this vulnerability could then perform actions and run scripts in the security context of the user. This security update addresses the vulnerability by ensuring Power BI Report Server properly validates content-type of the attachments when uploading and opening.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: May 21, 2020
Last modified: Aug 19, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-117316.1The Media Library Assistant plugin before 2.82 for Wordpress suffers from multiple XSS vulnerabilities in all Settings/Media Library Assista CVE-2020-117327.5The Media Library Assistant plugin before 2.82 for Wordpress suffers from a Local File Inclusion vulnerability in mla_gallery link=download.CVE-2020-117336.7An issue was discovered on Spirent TestCenter and Avalanche appliance admin interface firmware. An attacker, who already has access to an SS CVE-2020-117346.1cgi-bin/go in CyberSolutions CyberMail 5 or later allows XSS via the ACTION parameter.CVE-2020-117355.3The private-key operations in ecc.c in wolfSSL before 4.4.0 do not use a constant-time modular inverse when mapping to affine coordinates, a CVE-2020-117363.9fr-archive-libarchive.c in GNOME file-roller through 3.36.1 allows Directory Traversal during extraction because it lacks a check of whether CVE-2020-117376.1A cross-site scripting (XSS) vulnerability in Web Client in Zimbra 9.0 allows a remote attacker to craft links in an E-Mail message or calen CVE-2020-117387.5The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traversal via ../ in the f CVE-2020-117397.8An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service or possibly gain privileges because of m CVE-2020-11747.8A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who succ CVE-2020-117405.5An issue was discovered in xenoprof in Xen through 4.13.x, allowing guest OS users (without active profiling) to obtain sensitive informatio CVE-2020-117418.8An issue was discovered in xenoprof in Xen through 4.13.x, allowing guest OS users (with active profiling) to obtain sensitive information a