CVE-2024-8912— HTTP Request Smuggling in Looker
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-8912
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
HTTP Request Smuggling in Looker
Source: NVD (National Vulnerability Database)
Vulnerability Description
An HTTP Request Smuggling vulnerability in Looker allowed an unauthorized attacker to capture HTTP responses destined for legitimate users. There are two Looker versions that are hosted by Looker: * Looker (Google Cloud core) was found to be vulnerable. This issue has already been mitigated and our investigation has found no signs of exploitation. * Looker (original) was not vulnerable to this issue. Customer-hosted Looker instances were found to be vulnerable and must be upgraded. This vulnerability has been patched in all supported versions of customer-hosted Looker, which are available on the Looker download page https://download.looker.com/ . For Looker customer-hosted instances, please update to the latest supported version of Looker as soon as possible. The versions below have all been updated to protect from this vulnerability. You can download these versions at the Looker download page: * 23.12 -> 23.12.123+ * 23.18 -> 23.18.117+ * 24.0 -> 24.0.92+ * 24.6 -> 24.6.77+ * 24.8 -> 24.8.66+ * 24.10 -> 24.10.78+ * 24.12 -> 24.12.56+ * 24.14 -> 24.14.37+
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
HTTP请求的解释不一致性(HTTP请求私运)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Google Looker 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Google Looker是美国谷歌（Google）公司的一个智能商业平台。 Google Looker存在安全漏洞，该漏洞源于未经授权的攻击者可以捕获发送给合法用户的HTTP响应。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-8912
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-8912
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: Looker
- CVE-2025-12742
Remote Code Execution in Looker via Teradata JDBC Driver - CVE-2025-12741
Arbitrary File Write in Denodo dialect of Looker allows Remo - CVE-2025-12740
Remote Command Execution in Looker via IBM DB2 JDBC drive - CVE-2025-12739
Cross-Site Scripting (XSS) in Looker's Extension Loader lead - CVE-2025-12414
Looker account compromise via punycode homograph attack
Same weakness: CWE-444
- CVE-2026-40562
Gazelle versions through 0.49 for Perl allows HTTP Request S - CVE-2026-40561
Starlet versions through 0.31 for Perl allows HTTP Request S - CVE-2026-39805
CL.CL HTTP request smuggling via duplicate Content-Length in - CVE-2026-40560
Starman versions before 0.4018 for Perl allows HTTP Request - CVE-2026-41873
Pony Mail: Admin account takeover via request smuggling
V. Comments for CVE-2024-8912
No comments yet