PT-2020-13229 · Redash · Redash

0Xbadca7 · Published 2020-06-11 · Updated 2024-03-06 · CVE-2020-12725

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Redash open-source versions 8.0.0 and prior

Description An authenticated Server-Side Request Forgery (SSRF) was discovered via the JSON data source. This issue provides flexibility in crafting HTTP requests, such as adding headers and selecting any HTTP verb. Possibly, other connectors are affected.

Recommendations For Redash open-source versions 8.0.0 and prior, consider disabling the JSON data source as a temporary workaround until a patch is available. Restrict access to potentially vulnerable connectors to minimize the risk of exploitation.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BIT-REDASH-2020-12725

CVE-2020-12725

Affected Products

Redash

References · 7

• 🔥 https://github.com/getredash/redash/issues/4869 · Exploit
• https://github.com/getredash/redash/commits/master · Vendor Advisory
• https://blog.redash.io · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-12725 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-redash-2020-12725 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12725 · Security Note
• https://t.me/cvenotify/4319 · Telegram Post