Skip to content
OpenAdvisories
High WID-SEC-2025-1962 3 CVEs

Google Cloud Platform Looker Studio: Mehrere Schwachstellen

Published Sep 3, 2025 · Updated Nov 10, 2025 · Revision 2 · de-DE

Vendor: Google Product: Cloud Platform

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Google Cloud Platform Looker Studio ausnutzen, um SQL-Injection-Angriffe durchzuführen und vertrauliche Informationen offenzulegen.

Product

Google Cloud Platform (GCP) ist eine Sammlung von Cloud-Computing-Diensten von Google, die Infrastruktur, Datenanalyse, maschinelles Lernen und Entwicklungstools bietet. Unternehmen können dadurch Anwendungen in der Cloud zu aufbauen und skalierbar bereitzustellen.

Vulnerabilities 3

  • High 7.7
    CVE-2025-12405

    Unauthorized access through stored credentials in Looker Studio

    An improper privilege management vulnerability was found in Looker Studio. It impacted all JDBC-based connectors. A Looker Studio user with report view access could make a copy of the report and execute arbitrary SQL that would run on the data source database…

    Google Cloud Looker Studio
  • High 7.6
    CVE-2025-12397

    SQL Injection in Looker Studio

    A SQL injection vulnerability was found in Looker Studio. A Looker Studio user with report view access could inject malicious SQL that would execute with the report owner's permissions. The vulnerability affected to reports with BigQuery as the data source. T…

    Google Cloud Looker Studio
  • High 7.3
    CVE-2025-12409

    SQL Injection in Looker Studio

    A SQL injection vulnerability was discovered in Looker Studio that allowed for data exfiltration from BigQuery data sources. By creating a malicious report with native functions enabled, and having the victim access the report, an attacker could execute injec…

    Google Cloud Looker Studio

Revision history

  1. #2

    CVE-2025-12397, CVE-2025-12405, CVE-2025-12409 aufgenommen

  2. #1

    Initiale Fassung

References