CVE-2025-12743

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12743", "assignerOrgId": "f45cbf4e-4146-4068-b7e1-655ffc2c548c", "state": "PUBLISHED", "assignerShortName": "GoogleCloud", "dateReserved": "2025-11-05T10:51:12.658Z", "datePublished": "2025-11-19T16:41:30.639Z", "dateUpdated": "2025-11-19T18:47:37.355Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Looker-hosted"], "product": "Looker", "vendor": "Google Cloud", "versions": [{"lessThan": "24.12.106", "status": "affected", "version": "0", "versionType": "date"}, {"lessThan": "24.18.198", "status": "affected", "version": "0", "versionType": "date"}, {"lessThan": "25.0.75", "status": "affected", "version": "0", "versionType": "date"}, {"lessThan": "25.6.63", "status": "affected", "version": "0", "versionType": "date"}, {"lessThan": "25.8.45", "status": "affected", "version": "0", "versionType": "date"}, {"lessThan": "25.10.33", "status": "affected", "version": "0", "versionType": "date"}, {"lessThan": "25.12.1", "status": "affected", "version": "0", "versionType": "date"}, {"lessThan": "25.14", "status": "affected", "version": "0", "versionType": "date"}]}, {"defaultStatus": "unaffected", "platforms": ["Self-hosted"], "product": "Looker", "vendor": "Google Cloud", "versions": [{"lessThan": "24.12.106", "status": "affected", "version": "0", "versionType": "date"}, {"lessThan": "24.18.198", "status": "affected", "version": "0", "versionType": "date"}, {"lessThan": "25.0.75", "status": "affected", "version": "0", "versionType": "date"}, {"lessThan": "25.6.63", "status": "affected", "version": "0", "versionType": "date"}, {"lessThan": "25.8.45", "status": "affected", "version": "0", "versionType": "date"}, {"lessThan": "25.10.33", "status": "affected", "version": "0", "versionType": "date"}, {"lessThan": "25.12.1", "status": "affected", "version": "0", "versionType": "date"}, {"lessThan": "25.14", "status": "affected", "version": "0", "versionType": "date"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Liv Matan from Tenable"}, {"lang": "en", "type": "finder", "value": "Tomas La\u017eauninkas"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The Looker endpoint for generating new projects from database connections allows users to specify \"looker\" as a connection name, which is a reserved internal name for Looker's internal MySQL database. The schemas parameter is vulnerable to SQL injection, enabling attackers to manipulate SELECT queries that are constructed and executed against the internal MySQL database. This vulnerability allows users with developer permissions to extract data from Looker's internal MySQL database.<br><br>Looker-hosted and Self-hosted were found to be vulnerable.<br>This issue has already been mitigated for Looker-hosted instances.&nbsp;No user action is required for these.<div><br></div><span style=\"background-color: rgb(252, 252, 252);\">Self-hosted instances must be upgraded <span style=\"background-color: rgb(252, 252, 252);\">as soon as possible</span>. This vulnerability has been patched in all supported versions of Self-hosted.</span><br><div><span style=\"background-color: rgb(252, 252, 252);\">The versions below have all been updated to protect against this vulnerability. You can download these versions at the Looker download page </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://download.looker.com/\">https://download.looker.com/</a><span style=\"background-color: rgb(252, 252, 252);\">:<br><ul><li><span style=\"background-color: rgb(252, 252, 252);\">24.12.106</span></li><li><span style=\"background-color: rgb(252, 252, 252);\">24.18.198+</span></li><li><span style=\"background-color: rgb(252, 252, 252);\">25.0.75</span></li><li><span style=\"background-color: rgb(252, 252, 252);\">25.6.63+</span></li><li><span style=\"background-color: rgb(252, 252, 252);\">25.8.45+</span></li><li><span style=\"background-color: rgb(252, 252, 252);\">25.10.33+</span></li><li><span style=\"background-color: rgb(252, 252, 252);\">25.12.1+</span></li><li><span style=\"background-color: rgb(252, 252, 252);\">25.14+</span></li></ul></span></div>"}], "value": "The Looker endpoint for generating new projects from database connections allows users to specify \"looker\" as a connection name, which is a reserved internal name for Looker's internal MySQL database. The schemas parameter is vulnerable to SQL injection, enabling attackers to manipulate SELECT queries that are constructed and executed against the internal MySQL database. This vulnerability allows users with developer permissions to extract data from Looker's internal MySQL database.\n\nLooker-hosted and Self-hosted were found to be vulnerable.\nThis issue has already been mitigated for Looker-hosted instances.\u00a0No user action is required for these.\n\n\nSelf-hosted instances must be upgraded as soon as possible. This vulnerability has been patched in all supported versions of Self-hosted.\nThe versions below have all been updated to protect against this vulnerability. You can download these versions at the Looker download page https://download.looker.com/ :\n * 24.12.106\n * 24.18.198+\n * 25.0.75\n * 25.6.63+\n * 25.8.45+\n * 25.10.33+\n * 25.12.1+\n * 25.14+"}], "impacts": [{"capecId": "CAPEC-66", "descriptions": [{"lang": "en", "value": "CAPEC-66 SQL Injection"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 6, "baseSeverity": "MEDIUM", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "RED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/U:Red", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f45cbf4e-4146-4068-b7e1-655ffc2c548c", "shortName": "GoogleCloud", "dateUpdated": "2025-11-19T16:41:30.639Z"}, "references": [{"url": "https://cloud.google.com/support/bulletins#gcp-2025-052"}, {"url": "https://www.tenable.com/security/research/tra-2025-43"}], "source": {"discovery": "UNKNOWN"}, "title": "SQL Injection in Looker Project Generation Endpoint Allows Access to Internal MySQL Database", "x_generator": {"engine": "Vulnogram 0.4.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-19T18:47:06.246892Z", "id": "CVE-2025-12743", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-19T18:47:37.355Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12743", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-19T18:47:06.246892Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-19T18:47:28.552Z"}}], "cna": {"title": "SQL Injection in Looker Project Generation Endpoint Allows Access to Internal MySQL Database", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Liv Matan from Tenable"}, {"lang": "en", "type": "finder", "value": "Tomas La\u017eauninkas"}], "impacts": [{"capecId": "CAPEC-66", "descriptions": [{"lang": "en", "value": "CAPEC-66 SQL Injection"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/U:Red", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "RED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Google Cloud", "product": "Looker", "versions": [{"status": "affected", "version": "0", "lessThan": "24.12.106", "versionType": "date"}, {"status": "affected", "version": "0", "lessThan": "24.18.198", "versionType": "date"}, {"status": "affected", "version": "0", "lessThan": "25.0.75", "versionType": "date"}, {"status": "affected", "version": "0", "lessThan": "25.6.63", "versionType": "date"}, {"status": "affected", "version": "0", "lessThan": "25.8.45", "versionType": "date"}, {"status": "affected", "version": "0", "lessThan": "25.10.33", "versionType": "date"}, {"status": "affected", "version": "0", "lessThan": "25.12.1", "versionType": "date"}, {"status": "affected", "version": "0", "lessThan": "25.14", "versionType": "date"}], "platforms": ["Looker-hosted"], "defaultStatus": "unaffected"}, {"vendor": "Google Cloud", "product": "Looker", "versions": [{"status": "affected", "version": "0", "lessThan": "24.12.106", "versionType": "date"}, {"status": "affected", "version": "0", "lessThan": "24.18.198", "versionType": "date"}, {"status": "affected", "version": "0", "lessThan": "25.0.75", "versionType": "date"}, {"status": "affected", "version": "0", "lessThan": "25.6.63", "versionType": "date"}, {"status": "affected", "version": "0", "lessThan": "25.8.45", "versionType": "date"}, {"status": "affected", "version": "0", "lessThan": "25.10.33", "versionType": "date"}, {"status": "affected", "version": "0", "lessThan": "25.12.1", "versionType": "date"}, {"status": "affected", "version": "0", "lessThan": "25.14", "versionType": "date"}], "platforms": ["Self-hosted"], "defaultStatus": "unaffected"}], "references": [{"url": "https://cloud.google.com/support/bulletins#gcp-2025-052"}, {"url": "https://www.tenable.com/security/research/tra-2025-43"}], "x_generator": {"engine": "Vulnogram 0.4.0"}, "descriptions": [{"lang": "en", "value": "The Looker endpoint for generating new projects from database connections allows users to specify \"looker\" as a connection name, which is a reserved internal name for Looker's internal MySQL database. The schemas parameter is vulnerable to SQL injection, enabling attackers to manipulate SELECT queries that are constructed and executed against the internal MySQL database. This vulnerability allows users with developer permissions to extract data from Looker's internal MySQL database.\n\nLooker-hosted and Self-hosted were found to be vulnerable.\nThis issue has already been mitigated for Looker-hosted instances.\u00a0No user action is required for these.\n\n\nSelf-hosted instances must be upgraded as soon as possible. This vulnerability has been patched in all supported versions of Self-hosted.\nThe versions below have all been updated to protect against this vulnerability. You can download these versions at the Looker download page https://download.looker.com/ :\n * 24.12.106\n * 24.18.198+\n * 25.0.75\n * 25.6.63+\n * 25.8.45+\n * 25.10.33+\n * 25.12.1+\n * 25.14+", "supportingMedia": [{"type": "text/html", "value": "The Looker endpoint for generating new projects from database connections allows users to specify \"looker\" as a connection name, which is a reserved internal name for Looker's internal MySQL database. The schemas parameter is vulnerable to SQL injection, enabling attackers to manipulate SELECT queries that are constructed and executed against the internal MySQL database. This vulnerability allows users with developer permissions to extract data from Looker's internal MySQL database.<br><br>Looker-hosted and Self-hosted were found to be vulnerable.<br>This issue has already been mitigated for Looker-hosted instances.&nbsp;No user action is required for these.<div><br></div><span style=\"background-color: rgb(252, 252, 252);\">Self-hosted instances must be upgraded <span style=\"background-color: rgb(252, 252, 252);\">as soon as possible</span>. This vulnerability has been patched in all supported versions of Self-hosted.</span><br><div><span style=\"background-color: rgb(252, 252, 252);\">The versions below have all been updated to protect against this vulnerability. You can download these versions at the Looker download page </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://download.looker.com/\">https://download.looker.com/</a><span style=\"background-color: rgb(252, 252, 252);\">:<br><ul><li><span style=\"background-color: rgb(252, 252, 252);\">24.12.106</span></li><li><span style=\"background-color: rgb(252, 252, 252);\">24.18.198+</span></li><li><span style=\"background-color: rgb(252, 252, 252);\">25.0.75</span></li><li><span style=\"background-color: rgb(252, 252, 252);\">25.6.63+</span></li><li><span style=\"background-color: rgb(252, 252, 252);\">25.8.45+</span></li><li><span style=\"background-color: rgb(252, 252, 252);\">25.10.33+</span></li><li><span style=\"background-color: rgb(252, 252, 252);\">25.12.1+</span></li><li><span style=\"background-color: rgb(252, 252, 252);\">25.14+</span></li></ul></span></div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "f45cbf4e-4146-4068-b7e1-655ffc2c548c", "shortName": "GoogleCloud", "dateUpdated": "2025-11-19T16:41:30.639Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12743", "state": "PUBLISHED", "dateUpdated": "2025-11-19T18:47:37.355Z", "dateReserved": "2025-11-05T10:51:12.658Z", "assignerOrgId": "f45cbf4e-4146-4068-b7e1-655ffc2c548c", "datePublished": "2025-11-19T16:41:30.639Z", "assignerShortName": "GoogleCloud"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Looker-hosted"], "product": "Looker", "vendor": "Google Cloud", "versions": [{"lessThan": "24.12.106", "status": "affected", "version": "0", "versionType": "date"}, {"lessThan": "24.18.198", "status": "affected", "version": "0", "versionType": "date"}, {"lessThan": "25.0.75", "status": "affected", "version": "0", "versionType": "date"}, {"lessThan": "25.6.63", "status": "affected", "version": "0", "versionType": "date"}, {"lessThan": "25.8.45", "status": "affected", "version": "0", "versionType": "date"}, {"lessThan": "25.10.33", "status": "affected", "version": "0", "versionType": "date"}, {"lessThan": "25.12.1", "status": "affected", "version": "0", "versionType": "date"}, {"lessThan": "25.14", "status": "affected", "version": "0", "versionType": "date"}]}, {"defaultStatus": "unaffected", "platforms": ["Self-hosted"], "product": "Looker", "vendor": "Google Cloud", "versions": [{"lessThan": "24.12.106", "status": "affected", "version": "0", "versionType": "date"}, {"lessThan": "24.18.198", "status": "affected", "version": "0", "versionType": "date"}, {"lessThan": "25.0.75", "status": "affected", "version": "0", "versionType": "date"}, {"lessThan": "25.6.63", "status": "affected", "version": "0", "versionType": "date"}, {"lessThan": "25.8.45", "status": "affected", "version": "0", "versionType": "date"}, {"lessThan": "25.10.33", "status": "affected", "version": "0", "versionType": "date"}, {"lessThan": "25.12.1", "status": "affected", "version": "0", "versionType": "date"}, {"lessThan": "25.14", "status": "affected", "version": "0", "versionType": "date"}]}], "source": "f45cbf4e-4146-4068-b7e1-655ffc2c548c"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Looker endpoint for generating new projects from database connections allows users to specify \"looker\" as a connection name, which is a reserved internal name for Looker's internal MySQL database. The schemas parameter is vulnerable to SQL injection, enabling attackers to manipulate SELECT queries that are constructed and executed against the internal MySQL database. This vulnerability allows users with developer permissions to extract data from Looker's internal MySQL database.\n\nLooker-hosted and Self-hosted were found to be vulnerable.\nThis issue has already been mitigated for Looker-hosted instances.\u00a0No user action is required for these.\n\n\nSelf-hosted instances must be upgraded as soon as possible. This vulnerability has been patched in all supported versions of Self-hosted.\nThe versions below have all been updated to protect against this vulnerability. You can download these versions at the Looker download page https://download.looker.com/ :\n * 24.12.106\n * 24.18.198+\n * 25.0.75\n * 25.6.63+\n * 25.8.45+\n * 25.10.33+\n * 25.12.1+\n * 25.14+"}, {"lang": "es", "value": "El endpoint de Looker para generar nuevos proyectos a partir de conexiones a bases de datos permite a los usuarios especificar \u201clooker\u201d como nombre de conexi\u00f3n, el cual es un nombre interno reservado para la base de datos MySQL interna de Looker. El par\u00e1metro \u201cschemas\u201d es vulnerable a inyecci\u00f3n SQL, lo que permite a los atacantes manipular consultas SELECT que se construyen y ejecutan contra la base de datos MySQL interna. Esta vulnerabilidad permite a los usuarios con permisos de desarrollador extraer datos de la base de datos MySQL interna de Looker.\n\nLooker-hosted y Self-hosted se encontraron vulnerables.\nEste problema ya ha sido mitigado para las instancias Looker-hosted. No se requiere ninguna acci\u00f3n por parte del usuario para estas.\n\nLas instancias Self-hosted deben actualizarse lo antes posible. Esta vulnerabilidad ha sido parcheada en todas las versiones compatibles de Self-hosted.\nLas versiones a continuaci\u00f3n han sido todas actualizadas para proteger contra esta vulnerabilidad. Puede descargar estas versiones en la p\u00e1gina de descarga de Looker https://download.looker.com/ :\n * 24.12.106\n * 24.18.198+\n * 25.0.75\n * 25.6.63+\n * 25.8.45+\n * 25.10.33+\n * 25.12.1+\n * 25.14+"}], "id": "CVE-2025-12743", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.0, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "RED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "f45cbf4e-4146-4068-b7e1-655ffc2c548c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12743", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-19T18:47:06.246892Z", "version": "2.0.3"}}]}, "published": "2025-11-19T17:15:46.003", "references": [{"source": "f45cbf4e-4146-4068-b7e1-655ffc2c548c", "url": "https://cloud.google.com/support/bulletins#gcp-2025-052"}, {"source": "f45cbf4e-4146-4068-b7e1-655ffc2c548c", "url": "https://www.tenable.com/security/research/tra-2025-43"}], "sourceIdentifier": "f45cbf4e-4146-4068-b7e1-655ffc2c548c", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "f45cbf4e-4146-4068-b7e1-655ffc2c548c", "type": "Secondary"}]}

{}

{"created": "2025-11-24T09:10:56.537914+00:00", "updated": "2025-11-24T09:10:56.537955+00:00", "vendors": ["google", "google$PRODUCT$cloud_looker"]}