{"id":"CVE-2025-12409","state":"PUBLISHED","title":"SQL Injection in Looker Studio","description":"A SQL injection vulnerability was discovered in Looker Studio that allowed for data exfiltration from BigQuery data sources.\n \nBy creating a malicious report with native functions enabled, and having the victim access the report, an attacker could execute injected SQL queries with the victim's permissions in BigQuery.\n\nThis vulnerability was patched on 07 July 2025, and no customer action is needed.","publishedAt":"2025-11-10T08:59:15.899Z","updatedAt":"2025-11-10T15:16:16.715Z","severity":{"score":7.3,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/U:Clear","source":"GoogleCloud"},"assigner":"GoogleCloud","products":["Google Cloud Looker Studio"],"affected":[{"vendor":"Google Cloud","product":"Looker Studio","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2025-07-07","versionType":"date"}]}],"references":["https://cloud.google.com/support/bulletins#gcp-2025-053","https://www.tenable.com/security/research/tra-2025-27"],"weaknesses":["CWE-89"],"ingestedAt":"2026-10-29T20:08:31.050Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/12xxx/CVE-2025-12409.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-12409","state":"PUBLISHED","datePublished":"2025-11-10T08:59:15.899Z","dateUpdated":"2025-11-10T15:16:16.715Z","assignerShortName":"GoogleCloud","assignerOrgId":"f45cbf4e-4146-4068-b7e1-655ffc2c548c","dateReserved":"2025-10-28T15:17:15.305Z"},"containers":{"cna":{"title":"SQL Injection in Looker Studio","descriptions":[{"lang":"en","value":"A SQL injection vulnerability was discovered in Looker Studio that allowed for data exfiltration from BigQuery data sources.\n \nBy creating a malicious report with native functions enabled, and having the victim access the report, an attacker could execute injected SQL queries with the victim's permissions in BigQuery.\n\nThis vulnerability was patched on 07 July 2025, and no customer action is needed."}],"affected":[{"vendor":"Google Cloud","product":"Looker Studio","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2025-07-07","versionType":"date"}]}],"references":[{"url":"https://cloud.google.com/support/bulletins#gcp-2025-053"},{"url":"https://www.tenable.com/security/research/tra-2025-27"}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":7.3,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"CLEAR","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/U:Clear","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","description":"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"GoogleCloud","orgId":"f45cbf4e-4146-4068-b7e1-655ffc2c548c","dateUpdated":"2025-11-10T09:29:08.084Z"},"credits":[{"lang":"en","type":"finder","value":"Liv Matan from Tenable."}],"impacts":[{"capecId":"CAPEC-66","descriptions":[{"lang":"en","value":"CAPEC-66 SQL Injection"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.4.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-11-10T15:14:54.971898Z","id":"CVE-2025-12409","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-11-10T15:16:16.715Z"}}]}}}