CVE-2025-12405
Last modified
CVE-2025-12405 is a high-severity vulnerability rated 7.7/10 on the CVSS scale. An improper privilege management vulnerability was found in Looker Studio. It impacted all JDBC-based connectors. A Looker Studio user with report view access could make a copy of the report and execute arbitrary SQL that would run on the data source database due to the stored credentials attached to the report. This vulnerability was patched on 21 July 2025, and no customer action is needed.. EPSS estimates a 0.22% chance of exploitation in the next 30 days.
Description
An improper privilege management vulnerability was found in Looker Studio. It impacted all JDBC-based connectors. A Looker Studio user with report view access could make a copy of the report and execute arbitrary SQL that would run on the data source database due to the stored credentials attached to the report. This vulnerability was patched on 21 July 2025, and no customer action is needed.
Metrics
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-12405?
How severe is CVE-2025-12405?
How do I fix CVE-2025-12405?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-1240WinZip 7Z File Parsing Out-Of-Bounds Write Remote Code Execu…8.8
- CVE-2025-12400The LMB^Box Smileys plugin for WordPress is vulnerable to Cr…6.1
- CVE-2025-12401The Label Plugins plugin for WordPress is vulnerable to Cros…6.1
- CVE-2025-12402The LinkedIn Resume plugin for WordPress is vulnerable to Cr…6.1
- CVE-2025-12403The Associados Amazon Plugin plugin for WordPress is vulnera…6.1
- CVE-2025-12404The Like-it plugin for WordPress is vulnerable to Cross-Site…6.1
- CVE-2025-12406The Project Honey Pot Spam Trap plugin for WordPress is vuln…6.1
- CVE-2025-12407The Events Manager – Calendar, Bookings, Tickets, and more! …4.3
- CVE-2025-12408The Events Manager – Calendar, Bookings, Tickets, and more! …5.3
- CVE-2025-12409A SQL injection vulnerability was discovered in Looker Studi…7.3
- CVE-2025-1241Encrypted values in Fortra's GoAnywhere MFT prior to version…4.9
- CVE-2025-12410The SH Contextual Help plugin for WordPress is vulnerable to…6.1
Are you affected by CVE-2025-12405?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST