CVE-2025-12409
Gravedad CVSS v4.0:
ALTA
Tipo:
CWE-89
Neutralización incorrecta de elementos especiales usados en un comando SQL (Inyección SQL)
Fecha de publicación:
10/11/2025
Última modificación:
12/11/2025
Descripción
*** Pendiente de traducción *** A SQL injection vulnerability was discovered in Looker Studio that allowed for data exfiltration from BigQuery data sources.<br />
<br />
By creating a malicious report with native functions enabled, and having the victim access the report, an attacker could execute injected SQL queries with the victim&#39;s permissions in BigQuery.<br />
<br />
This vulnerability was patched on 07 July 2025, and no customer action is needed.