Homepage

redash@0.14.1 vulnerabilities

A better Standard Library for JavaScript

  • latest version

    0.23.0

  • first published

    8 years ago

  • latest version published

    7 years ago

  • licenses detected

  • View redash package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the redash package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    LDAP Injection

    redash is an A better Standard Library for JavaScript

    Affected versions of this package are vulnerable to LDAP Injection. Redash is affected by LDAP Injection. There is an authentication bypass and information leak through the crafting of special queries, escaping the provided template because the ldap_user = auth_ldap_user(request.form["email"], request.form["password"]) auth_ldap_user(username, password) settings.LDAP_SEARCH_TEMPLATE % {"username": username} code lacks sanitization.

    How to fix LDAP Injection?

    There is no fixed version for redash.

    *
    • H
    Server-side Request Forgery (SSRF)

    redash is an A better Standard Library for JavaScript

    Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the JSON data source. Possibly, other connectors are affected. The SSRF is potent and provides a lot of flexibility in terms of being able to craft HTTP requests e.g., by adding headers, selecting any HTTP verb, etc.

    How to fix Server-side Request Forgery (SSRF)?

    There is no fixed version for redash.

    *
    Go back to all versions of this package