CVE-2025-12397

A SQL injection vulnerability was found in Looker Studio. A Looker Studio user with report view access could inject malicious SQL that would execute with the report owner's permissions. The vulnerability affected to reports with BigQuery as the data source. This vulnerability was patched on 21 July 2025, and no customer action is needed.

CVSS

No CVSS.

References

Link	Resource
https://cloud.google.com/support/bulletins#gcp-2025-053
https://www.tenable.com/security/research/tra-2025-28

Configurations

No configuration.

History

10 Nov 2025, 09:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-11-10 09:15

Updated : 2025-11-12 16:19

NVD link : CVE-2025-12397

Mitre link : CVE-2025-12397

CVE.ORG link : CVE-2025-12397

JSON object : View

Products Affected

No product.

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2025-12397", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "f45cbf4e-4146-4068-b7e1-655ffc2c548c", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "CLEAR", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-11-10T09:15:41.913", "references": [{"url": "https://cloud.google.com/support/bulletins#gcp-2025-053", "source": "f45cbf4e-4146-4068-b7e1-655ffc2c548c"}, {"url": "https://www.tenable.com/security/research/tra-2025-28", "source": "f45cbf4e-4146-4068-b7e1-655ffc2c548c"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "f45cbf4e-4146-4068-b7e1-655ffc2c548c", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "A SQL injection vulnerability was found in Looker Studio.\n\nA Looker Studio user with report view access could inject malicious SQL that would execute with the report owner's permissions. The vulnerability affected to reports with BigQuery as the data source.\n\nThis vulnerability was patched on 21 July 2025, and no customer action is needed."}], "lastModified": "2025-11-12T16:19:59.103", "sourceIdentifier": "f45cbf4e-4146-4068-b7e1-655ffc2c548c"}

CVE-2025-12397

JSON object

Attach tags to CVE-2025-12397

Attach tags to `CVE-2025-12397`