CVE-2020-12725

Redash open-source versions 8.0.0 and prior are affected by an authenticated SSRF via the JSON data source. The issue allows crafting arbitrary HTTP requests (custom headers, any verb) from within the data source, with potential impact to downstream services. Affected connectors beyond JSON are p...

CVE-2020-12725

Havoc Research discovered an authenticated Server-Side Request Forgery SSRF via the "JSON" data source of Redash open-source 8.0.0 and prior. Possibly, other connectors are affected. The SSRF is potent and provides a lot of flexibility in terms of being able to craft HTTP requests e.g., by adding...