CVE-2024-5166 Insecure Direct Object Reference In Looker
Authenticated users can access metadata from other users sharing the same LookML model, leading to information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-5166?
CVE-2024-5166 is a medium-severity vulnerability in Google Cloud Looker, published on 22 May 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An Insecure Direct Object Reference in Google Cloud's Looker allowed metadata exposure across authenticated Looker users sharing the same LookML model.
Weakness: CWE-639
Which versions are affected by CVE-2024-5166?
It affects 1 product.
Products include Google Looker.
How do I fix CVE-2024-5166?
No fix has been published for CVE-2024-5166 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-5166 being exploited?
There is no known exploitation of CVE-2024-5166 in the wild and no public exploit code.
Sources
Also known as GHSA-x2h9-8xx4-4xfr.