Forum Discussion
Confused by tenable.com on remote code execution vulnerability in Power BI Report Server
Dear Microsoft:
The following posting by tenable.com has alerted our CyberSecurity team to push us to find “Power BI Report Server version 2.94.921.0 or later” to address “remote code execution vulnerability”:
https://www.tenable.com/plugins/nessus/151623
Would you please clarify? On-premises Report Server version has not come out with this fix, if the information from tenable.com is correct:
https://docs.microsoft.com/en-us/power-bi/report-server/changelog
Thank you,
Michael Xu, P. Eng.
System Analyst, Information Systems
CNRL +1 403-386-5168
Microsoft Certified: DA, DE, DS, DBA
3 Replies
That version number is not in the range used by Power BI Server (the current May 2021 release is v1.11)
That looks like a Power BI Desktop number and if you follow the "see also" link on tenable it points to an article referencing an issue with Power BI Desktop. So indirectly this is probably also an issue with the May 2021 release of report server. The next release of Report Server is scheduled for September (they release 3 times a year in January, May and September) and it looks like this would probably include this fix (since it should include the yet to be released Sept update of PBI Desktop).
Otherwise you could try and make sure your users only use 3rd party visuals that your security department are happy with or you could try raising an official support ticket with Microsoft, but I think that would be a bit of a long shot.Hi Anonymous ,
I agree with what d_gosbell said.
And in addition, 2.94.921.0 is one version of Power BI Desktop June 2021. You can find the rules from these version numbers:
April 2021 Update (2.92.706.0)
And from here, we can find that 2.94.921.0 is an update version of Power BI Desktop June 2021, published on June 30, 2021.
Best Regards,
Icey
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.
