Lucene search

[email protected]CVE-2024-5166

HistoryMay 22, 2024 - 5:16 p.m.

CVE-2024-5166

2024-05-2217:16:15

CWE-639

[email protected]

web.nvd.nist.gov

google cloud

looker

insecure direct object reference

metadata exposure

lookml model

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.5 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.0%

JSON

An Insecure Direct Object Reference in Google Cloud’s Looker allowed metadata exposure across authenticated Looker users sharing the same LookML model.

Affected configurations

Vulners

Node

google_cloudlookerRange≤23.18

google_cloudlookerRange≤23.20

google_cloudlookerRange≤24.0

google_cloudlookerRange≤24.2

google_cloudlookerRange≤24.4

google_cloudlookerRange≤24.6

google_cloudlookerRange≤24.8

google_cloudlookerRange≤24.10

google_cloudlookerRange≤24.12

google_cloudlookerRange≤24.14

google_cloudlookerRange≤24.16

google_cloudlookerRange≤24.18

google_cloudlookerRange≤24.20

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Looker",
    "vendor": "Google Cloud",
    "versions": [
      {
        "status": "affected",
        "version": "23.18"
      },
      {
        "status": "affected",
        "version": "23.20"
      },
      {
        "status": "affected",
        "version": "24.0"
      },
      {
        "status": "affected",
        "version": "24.2"
      },
      {
        "status": "affected",
        "version": "24.4"
      },
      {
        "status": "affected",
        "version": "24.6"
      },
      {
        "status": "affected",
        "version": "24.8"
      },
      {
        "status": "affected",
        "version": "24.10"
      },
      {
        "status": "affected",
        "version": "24.12"
      },
      {
        "status": "affected",
        "version": "24.14"
      },
      {
        "status": "affected",
        "version": "24.16"
      },
      {
        "status": "affected",
        "version": "24.18"
      },
      {
        "status": "affected",
        "version": "24.20"
      }
    ]
  }
]

References

cloud.google.com/looker/docs/best-practices/query-id-update-instructions

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.5 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.0%

JSON

Related for CVE-2024-5166

nvd1 vulnrichment1 cvelist1