CVE-2023-50786CWE-294

Dradis through 4.16.0 allows referencing external images (resources) over HTTPS, instead of forcing the use of embedded (uploaded) images

Medium · published July 5, 2025

CVSS v3.1
4.1
EPSS
0%
Percentile
19.0
In the wild
Unconfirmed
What it is

Dradis through 4.16.0 allows referencing external images (resources) over HTTPS, instead of forcing the use of embedded (uploaded) images. This can be leveraged by an authorized author to attempt to steal the Net-NTLM hashes of other authors on a Windows domain network.

The record
Technical detail
CVSS v3.1
4.1 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00276 · 19.0th percentile
Weakness
CWE-294 · Authentication Bypass by Capture-replay
Published
2025-07-05T00:00Z
EPSS history
Timeline
  • 05 JUL 00:00Z
    Dradis through 4.16.0 allows referencing external images (resources) over HTTPS, instead of forcing the use of embedded (uploaded) images
    cvelistv5