Cross-Site Scripting (XSS) in Looker allows Admin Account Takeover
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Google Cloud | Looker | unaffected |
|
|||||||||||||||||||||||||||
| Google Cloud | Looker | unaffected |
|
No data.
No data.
| Vendor | Product | Versions | ||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Cloud Looker |
|
|||||||||||||||||||||||||||||||||||||
| Cloud Looker |
|
Vendor Solution
This vulnerability has been mitigated for Looker-hosted instances, and no user action is required. For Self-hosted Looker instances, customers should upgrade to one of the patched versions or later: 25.6.103+, 25.12.65+, 25.18.68+, 26.0.66+, 26.2.47+, 26.4.36+, 26.6.28+, or 26.8.7+.
No CVSS v3.1
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.453% probability within 30 days)
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Google
Google cloud Looker |
|
| Vendors & Products |
Google
Google cloud Looker |
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A Cross-Site Scripting (XSS) vulnerability in Google Cloud Looker versions prior to 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7 on Looker-hosted and Self-hosted allows an attacker to execute arbitrary JavaScript leading to administrative account takeover using a maliciously crafted URL. Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been mitigated for Looker-hosted instances. No user action is required for these. Self-hosted instances must be upgraded to the patched versions: 25.6.103+, 25.12.65+, 25.18.68+, 26.0.66+, 26.2.47+, 26.4.36+, 26.6.28+, or 26.8.7+. | |
| Title | Cross-Site Scripting (XSS) in Looker allows Admin Account Takeover | |
| Weaknesses | CWE-79 | |
| References |
| |
| Metrics |
cvssV4_0
|