CVE-2019-1332

Think of your reporting server like a shared bulletin board where employees view business reports. This flaw lets an attacker slip a hidden, malicious note onto that board — so when a trusted user clicks a crafted link, the attacker's code runs inside their browser session instead of just displaying a report. It requires tricking someone into clicking a link, it doesn't happen automatically.

This matters to you if your business runs SQL Server 2017 Reporting Services, SQL Server 2019 Reporting Services, or Power BI Report Server to generate or view business reports. It's only a risk if a user can be lured into clicking a malicious link pointing at your reporting server, since the attack requires some user interaction rather than happening silently.

There's a public proof-of-concept exploit available and researcher/press attention is rising, but there is no confirmed evidence of active exploitation in the wild. Treat this as a genuine priority to patch in the near term, not an emergency requiring immediate emergency action tonight.

Confirm exposure by inventorying all SSRS instances (SQL Server 2017 and 2019 Reporting Services) and Power BI Report Server deployments, noting whether they are internet-facing or internal-only. Apply the Microsoft security update referenced in the official MSRC advisory (https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1332) — Microsoft does not list a single standalone CVE-numbered package version; instead the fix ships as a cumulative update/security update for the specific SSRS release branch, so match the KB article to your exact build. There is no CISA KEV due date since this CVE is not currently listed in KEV. As a temporary mitigation while patching is scheduled, restrict SSRS access to trusted networks/VPN, enable browser XSS protections, and educate users against clicking unsolicited report links. Monitor for the public GitHub PoC being adapted into phishing campaigns, and watch EPSS trend (currently rising) as a leading indicator of future wild exploitation.

CVSS 3.1 score 6.1 (Medium), vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N — network-exploitable, low complexity, no privileges required, but requires user interaction, with a confidentiality/integrity-limited, scope-changed impact typical of XSS. Weakness class is CWE-79 (improper neutralization of input during web page generation). Exploit maturity: one public PoC exists on GitHub; EPSS predicts a 10.8% likelihood of exploitation (96th percentile, rising trend), indicating above-average but not confirmed exploitation activity. Not present in CISA's KEV catalog, so no confirmed in-the-wild exploitation has been reported to date; press/pulse attention is rising but reflects visibility rather than confirmed attacks.