CVE-2025-12743
BaseFortify
Publication date: 2025-11-19
Last updated on: 2025-11-19
Assigner: GoogleCloud
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| looker | looker | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Looker endpoint that generates new projects from database connections. It allows users to specify "looker" as a connection name, which is reserved for Looker's internal MySQL database. The schemas parameter is vulnerable to SQL injection, enabling attackers with developer permissions to manipulate SELECT queries against the internal MySQL database and extract data.
How can this vulnerability impact me? :
If exploited, this vulnerability allows users with developer permissions to extract sensitive data from Looker's internal MySQL database by manipulating SQL queries. This could lead to unauthorized data disclosure and potential compromise of internal data stored within Looker.
What immediate steps should I take to mitigate this vulnerability?
For Looker-hosted instances, no user action is required as the issue has already been mitigated. For Self-hosted instances, you should upgrade to one of the patched versions as soon as possible. The patched versions include 24.12.106, 24.18.198+, 25.0.75, 25.6.63+, 25.8.45+, 25.10.33+, 25.12.1+, and 25.14+. You can download these versions from the Looker download page at https://download.looker.com/.