Insecure Direct Object Reference In Looker
CVE-2024-5166

6.5MEDIUM

Key Information:

Vendor

Google Cloud

Status
Looker
Vendor
CVE Published:
22 May 2024

What is CVE-2024-5166?

An Insecure Direct Object Reference in Google Cloud's Looker allowed metadata exposure across authenticated Looker users sharing the same LookML model.

Affected Version(s)

Looker 23.18

Looker 23.20

Looker 24.0

References

https://cloud.google.com/looker/docs/best-practices/query...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

Credit

Ionut Cernica with the UiPath Security Team
.
CVE-2024-5166 : Insecure Direct Object Reference In Looker