1. Home
  2. CVE Database
  3. CVE-2023-50786
MEDIUM · 4.1

CVE-2023-50786

Dradis through 4.16.0 allows referencing external images (resources) over HTTPS, instead of forcing the use of embedded (uploaded) images. This can be leveraged by an authorized author to attempt to s...

Vulnerability Description

Dradis through 4.16.0 allows referencing external images (resources) over HTTPS, instead of forcing the use of embedded (uploaded) images. This can be leveraged by an authorized author to attempt to steal the Net-NTLM hashes of other authors on a Windows domain network.

CVSS Score

4.1

MEDIUM

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
Attack Vector
ADJACENT_NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality
NONE
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
DradisframeworkDradis<= 4.16.0

Related Weaknesses (CWE)

CWE-294

References

FAQ

What is CVE-2023-50786?

CVE-2023-50786 is a vulnerability with a CVSS score of 4.1 (MEDIUM). Dradis through 4.16.0 allows referencing external images (resources) over HTTPS, instead of forcing the use of embedded (uploaded) images. This can be leveraged by an authorized author to attempt to s...

How severe is CVE-2023-50786?

CVE-2023-50786 has been rated MEDIUM with a CVSS base score of 4.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-50786?

Check the references section above for vendor advisories and patch information. Affected products include: Dradisframework Dradis.