CVE-2025-12739highCWE-79

CVE-2025-12739: falha de alta gravidade em Google Cloud Looker

Cross-Site Scripting (XSS) in Looker's Extension Loader leading to Admin Account Compromise

Publicada em

Seguir esta CVE+ Monitorar Looker

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.3epss 0.3%
An attacker with viewer permissions in Looker could craft a malicious URL that, when opened by a Looker admin, would execute an attacker-supplied script. Exploitation required at least one Looker extension installed on the instance. Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been mitigated for Looker-hosted instances. No user action is required for these. Self-hosted instances must be upgraded as soon as possible. This vulnerability has been patched in all supported versions of Self-hosted. The versions below have all been updated to protect from this vulnerability. You can download these versions at the Looker download page https://download.looker.com/ : * 24.18.201+ * 25.0.79+ * 25.6.66+ * 25.12.7+ * 25.16.0+ * 25.18.0+ * 25.20.0+
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Red
Produtos afetados
Google Cloud · Looker
CVEs relacionadas — Google Cloud Looker

No mesmo produto, das mais perigosas para as menos.

CVE-2025-12155HIGHCommand Injection in LookerEPSS 1.3%CVE-2026-15810HIGHCross-Site Scripting (XSS) in Looker allows Admin Account TakeoverEPSS 0.5%CVE-2025-12414CRITICALLooker account compromise via punycode homograph attackEPSS 0.4%CVE-2025-12743MEDIUMSQL Injection in Looker Project Generation Endpoint Allows Access to Internal MySQL DatabaseEPSS 0.3%CVE-2025-12472HIGHRemote Code Execution in Looker due to Improperly Validated Directory DeletionEPSS 0.3%CVE-2025-12741HIGHArbitrary File Write in Denodo dialect of Looker allows Remote Code ExecutionEPSS 0.3%