« Volver al listado

CVE-2024-5166

Estado: AnalizadaMedia (6.5)—

An Insecure Direct Object Reference in Google Cloud's Looker allowed metadata exposure across authenticated Looker users sharing the same LookML model.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Google — Looker

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-5166",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-5166",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-05-22T19:50:49.820213Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve-coordination@google.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve-coordination@google.com",
      "affectedData": [
        {
          "vendor": "Google Cloud",
          "product": "Looker",
          "versions": [
            {
              "status": "affected",
              "version": "23.18"
            },
            {
              "status": "affected",
              "version": "23.20"
            },
            {
              "status": "affected",
              "version": "24.0"
            },
            {
              "status": "affected",
              "version": "24.2"
            },
            {
              "status": "affected",
              "version": "24.4"
            },
            {
              "status": "affected",
              "version": "24.6"
            },
            {
              "status": "affected",
              "version": "24.8"
            },
            {
              "status": "affected",
              "version": "24.10"
            },
            {
              "status": "affected",
              "version": "24.12"
            },
            {
              "status": "affected",
              "version": "24.14"
            },
            {
              "status": "affected",
              "version": "24.16"
            },
            {
              "status": "affected",
              "version": "24.18"
            },
            {
              "status": "affected",
              "version": "24.20"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-05-22T17:16:15.957",
  "references": [
    {
      "url": "https://cloud.google.com/looker/docs/best-practices/query-id-update-instructions",
      "tags": [
        "Product"
      ],
      "source": "cve-coordination@google.com"
    },
    {
      "url": "https://cloud.google.com/looker/docs/best-practices/query-id-update-instructions",
      "tags": [
        "Product"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve-coordination@google.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An Insecure Direct Object Reference in Google Cloud's Looker allowed metadata exposure across authenticated Looker users sharing the same LookML model."
    },
    {
      "lang": "es",
      "value": "Una referencia de objeto directa insegura en Looker de Google Cloud permitió la exposición de metadatos entre usuarios autenticados de Looker que compartían el mismo modelo LookML."
    }
  ],
  "lastModified": "2026-06-17T08:15:19.900",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:google:looker:23.18:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "35DADF6C-5886-4581-99BF-45B69799A2DF"
            },
            {
              "criteria": "cpe:2.3:a:google:looker:23.20:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7503C5F0-9117-4FA7-9E40-EA1330DD36DA"
            },
            {
              "criteria": "cpe:2.3:a:google:looker:24.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "748F483C-28A7-4D23-AC1B-504599DF4115"
            },
            {
              "criteria": "cpe:2.3:a:google:looker:24.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0669F449-7F7A-47C5-B92B-645B0899D25C"
            },
            {
              "criteria": "cpe:2.3:a:google:looker:24.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "98E862C4-3B4C-43B2-84BB-98AC9BD6F671"
            },
            {
              "criteria": "cpe:2.3:a:google:looker:24.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "976DB9CD-0A33-4072-B314-0BFE3F4D9A82"
            },
            {
              "criteria": "cpe:2.3:a:google:looker:24.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4428B311-99F8-4D48-9631-E9383B4468B0"
            },
            {
              "criteria": "cpe:2.3:a:google:looker:24.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F3413C68-2A24-405D-B594-B1575C0B0CE3"
            },
            {
              "criteria": "cpe:2.3:a:google:looker:24.12:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "81907A42-E3EB-41AD-ADDC-1208BED1DE91"
            },
            {
              "criteria": "cpe:2.3:a:google:looker:24.14:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "01E5496C-F3CF-424B-9503-3ABC66CC2AE5"
            },
            {
              "criteria": "cpe:2.3:a:google:looker:24.16:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D6EB2EFA-B666-4FD2-8439-343419388E7B"
            },
            {
              "criteria": "cpe:2.3:a:google:looker:24.18:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "03EA95CD-99BC-45A5-A2B2-A5A713EE8634"
            },
            {
              "criteria": "cpe:2.3:a:google:looker:24.20:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CEE5626A-D8DD-49F7-9361-31EE071BCDF0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve-coordination@google.com"
}