CVEvulnerability

CVE-2023-50786

4.3 MEDIUM Published 2025-07-05 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2025-07-05
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.1 MEDIUM — CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
CVSS 3.1 ([email protected])
4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-294

Description

Dradis through 4.16.0 allows referencing external images (resources) over HTTPS, instead of forcing the use of embedded (uploaded) images. This can be leveraged by an authorized author to attempt to steal the Net-NTLM hashes of other authors on a Windows domain network.

Affected configurations

• dradisframework dradis (<= 4.16.0)

Related

Weakness · CWE (1)

  • CWE-294 Authentication Bypass by Capture-replay weakness

References