LDAP Injection Vulnerability in Redash 8.0.0 by GetRedash
CVE-2020-36144

5.3MEDIUM

Key Information:

Vendor

Redash

Status
Redash
Vendor
CVE Published:
18 March 2021

What is CVE-2020-36144?

Redash 8.0.0 is affected by a vulnerability that allows an LDAP Injection attack. This issue arises from insufficient sanitization of user input in search filters, particularly the username. By crafting specific queries, attackers can exploit this lack of validation to manipulate LDAP queries, leading to unintentional information disclosure. Organizations using this version should review security measures and apply corrective actions to mitigate this risk.

References

https://github.com/getredash/redash/releases
x_refsource_MISC
https://github.com/getredash/redash/issues/5426
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.