CVE-2020-1173: 
vulnerability analysis and mitigation

A spoofing vulnerability (CVE-2020-1173) was discovered in Microsoft Power BI Report Server, specifically in how it validates the content-type of uploaded attachments. The vulnerability was disclosed on May 21, 2020, affecting Microsoft Power BI Report Server versions prior to 15.0.1102.646 (NVD, CVE).

The vulnerability stems from improper input validation (CWE-20) in the way Microsoft Power BI Report Server handles content-type validation for uploaded attachments. The vulnerability has been assigned a CVSS v3.1 base score of 6.8 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N, indicating network accessibility with low attack complexity, requiring low privileges and user interaction (NVD).

If exploited, this vulnerability could allow an authenticated attacker to perform spoofing attacks by uploading specially crafted payloads. The attacker could potentially execute actions and run scripts in the security context of the user viewing the malicious content (NVD).

The vulnerability requires authentication and user interaction for successful exploitation. An attacker would need to upload a specially crafted payload and convince a user to interact with it. The attack complexity is considered low, making it relatively straightforward to exploit once the prerequisites are met (NVD).

Microsoft addressed this vulnerability in the September 2019 release (version 1.6.7236.4246, Build 15.0.1102.646) by improving the validation of content-type for attachments during upload and opening operations. Users are advised to upgrade to this version or later to protect against this vulnerability (NVD).