CVE-2020-36144

Redash 8.0.0 is affected by LDAP Injection. There is an authentication bypass and information leak through the crafting of special queries, escaping the provided template because the ldap_user = auth_ldap_user(request.form[«email»], request.form[«password»]) auth_ldap_user(username, password) settings.LDAP_SEARCH_TEMPLATE % {«username»: username} code lacks sanitization.