Skip to content
fr Sign in
6.5 Medium

CVE-2024-5166 An Insecure Direct Object Reference in Google Cloud's Looker allowed metadata exposure across authenticated Looker users…

Description

An Insecure Direct Object Reference in Google Cloud's Looker allowed metadata exposure across authenticated Looker users sharing the same LookML model.

Affected products and versions

Product Affected versions Fixed in
Looker 24.20 No fix stated
Looker 24.18 No fix stated
Looker 24.16 No fix stated
Looker 24.14 No fix stated
Looker 24.12 No fix stated
Looker 24.10 No fix stated
Looker 24.8 No fix stated
Looker 24.6 No fix stated
Looker 24.4 No fix stated
Show the 4 other branches
Product Affected versions Fixed in
Looker 24.2 No fix stated
Looker 24.0 No fix stated
Looker 23.20 No fix stated
Looker 23.18 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Looker

The 10 CVEs of Looker →
CVE-2026-15810 A Cross-Site Scripting (XSS) vulnerability in Google Cloud Looker versions prior to 25.6.103, 25.12.65, 25.18.68,… 8.7 High CVE-2025-12742 A Looker user with a Developer role could cause Looker to execute a malicious command, due to insecure processing of… 7.5 High CVE-2025-12741 A Looker user with Developer role could create a database connection using Denodo driver and, by manipulating LookML,… 7.7 High CVE-2025-12740 A Looker user with a Developer role could create a database connection using IBM DB2 driver and, by manipulating LookML,… 7.7 High
Track this CVE