Description
Redash 8.0.0 is affected by LDAP Injection. There is an information leak through the crafting of special queries, escaping the provided template since the username included in the search filter lacks sanitization.
Remediation
References
https://github.com/getredash/redash/issues/5426
https://github.com/getredash/redash/releases
Related Vulnerabilities
CVE-2023-33831 Vulnerability in npm package @frangoteam/fuxa
CVE-2022-42004 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind
CVE-2022-45398 Vulnerability in maven package org.zeroturnaround:cluster-stats
CVE-2022-28820 Vulnerability in maven package com.adobe.acs:acs-aem-commons-ui.apps
CVE-2022-2900 Vulnerability in maven package org.webjars.npm:parse-url