Confused by tenable.com on remote code execution vulnerability in Power BI Report Server

[Anonymous]

Dear Microsoft:

The following posting by tenable.com has alerted our CyberSecurity team to push us to find “Power BI Report Server version 2.94.921.0 or later” to address “remote code execution vulnerability”:

https://www.tenable.com/plugins/nessus/151623

Would you please clarify? On-premises Report Server version has not come out with this fix, if the information from tenable.com is correct:

https://docs.microsoft.com/en-us/power-bi/report-server/changelog

Thank you,

Michael Xu, P. Eng.

System Analyst, Information Systems

CNRL    +1 403-386-5168

Microsoft Certified: DA, DE, DS, DBA

[Icey]

Hi @Anonymous ,

I agree with what @d_gosbell  said. 

And in addition, 2.94.921.0 is one version of Power BI Desktop June 2021. You can find the rules from these version numbers:

July 2021 Update (2.95.804.0)

June 2021 Update (2.94.781.0)

May 2021 Update (2.93.384.0)

April 2021 Update (2.92.706.0)

And from here, we can find that 2.94.921.0 is an update version of Power BI Desktop June 2021, published on June 30, 2021.

Best Regards,

Icey

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[d_gosbell]

That version number is not in the range used by Power BI Server (the current May 2021 release is v1.11)

That looks like a Power BI Desktop number and if you follow the "see also" link on tenable it points to an article referencing an issue with Power BI Desktop. So indirectly this is probably also an issue with the May 2021 release of report server. The next release of Report Server is scheduled for September (they release 3 times a year in January, May and September) and it looks like this would probably include this fix (since it should include the yet to be released Sept update of PBI Desktop).

Otherwise you could try and make sure your users only use 3rd party visuals that your security department are happy with or you could try raising an official support ticket with Microsoft, but I think that would be a bit of a long shot.

[Anonymous · Accepted solution]

Thank you Icey and d_gosbell! Looking forward for the Microsoft official On-premises version of PowerBI Report Server and Desktop that will address this issue.

Thank you,

Michael Xu, P. Eng.

System Analyst, Information Systems

CNRL    +1 403-386-5168

Microsoft Certified: DA, DE, DS, DBA