PT-2025-45607
CVE-2025-12409
·
Published
2025-11-10
·
Updated
2025-11-10
Description by
CVSS 4.0
7.3
HighMetricsAV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear
Name of the Vulnerable Software and Affected Versions
Looker Studio versions prior to 07 July 2025
Description
A SQL injection issue was identified in Looker Studio, potentially allowing unauthorized data exfiltration from BigQuery data sources. An attacker could create a malicious report with native functions enabled. When a victim accesses this report, the attacker could execute injected SQL queries using the victim’s permissions within BigQuery. The API endpoint used for this attack is not specified. The vulnerable parameter is not specified. The function
executeSQL() is potentially involved.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾