What is CVE-2022-23254?

CVE-2022-23254 is a security advisory published by Microsoft Security Response Center (MSRC) with High severity. Microsoft Power BI Information Disclosure Vulnerability

Which CVE IDs does CVE-2022-23254 cover?

CVE-2022-23254 covers the following CVE IDs: CVE-2022-23254. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of CVE-2022-23254?

CVE-2022-23254 has a CVSS v3 base score of 4.9, published by Microsoft Security Response Center (MSRC).

Which products are affected by CVE-2022-23254?

CVE-2022-23254 affects 1 product, including: PowerBI-client JS SDK.

CVE-2022-23254HighCVSS 4.9

Microsoft Power BI Information Disclosure Vulnerability

Vendor

Microsoft Security Response Center (MSRC)

Published

February 8, 2022

Last Modified

—

🔗 CVE IDs covered (1)

CVE-2022-23254 →

📋 Description

What actions do I need to take to be protected from this vulnerability? The main update will be automatically pushed to all affected products and services. We recommend that customers update PowerBI Client JS SDK to version 2.19.1. The package can be downloaded from NPM or NuGet Gallery. How do I know if I am affected? Our team will contact customers that are affected by this vulnerability. We recommend that affected customers save their Power Apps to ensure the fix takes effect as expected.

🎯 Affected products1

PowerBI-client JS SDK

✅ Remediation

KBRelease Notes (Security Update) — fixed build 2.19.1

🔗 References (2)

advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23254
patchhttps://www.nuget.org/packages/Microsoft.PowerBI.JavaScript/