This vulnerability (CVE-2024-43612) in Microsoft Power BI Report Server (version 15.0.0) is classified as CWE-79, indicating improper neutralization of input during web page generation leading to cross-site scripting (XSS). The CVSS 3.1 base score is 6.9 (medium severity), with network attack vector, low attack complexity, requiring high privileges and user interaction, and impacting confidentiality highly while integrity is low and availability is unaffected. The vulnerability allows an attacker with high privileges to inject malicious scripts that could compromise confidentiality. Microsoft has released an official fix for this vulnerability.

Successful exploitation could allow an attacker with high privileges to execute cross-site scripting attacks, potentially leading to disclosure of sensitive information (high confidentiality impact) but with limited integrity impact and no availability impact. The vulnerability requires user interaction and high privileges, limiting the attack scope.

An official fix is available from Microsoft for Power BI Report Server version 15.0.0. Users should apply the vendor-provided patch to remediate this vulnerability. Since this is not a cloud service, remediation depends on applying the update. No additional mitigation steps are indicated by the vendor advisory.