CVE-2023-50786

MEDIUM

Dradis < 4.16.0 - Net-NTLM Hash Theft via External Image Reference

Title source: llm

Description

Dradis through 4.16.0 allows referencing external images (resources) over HTTPS, instead of forcing the use of embedded (uploaded) images. This can be leveraged by an authorized author to attempt to steal the Net-NTLM hashes of other authors on a Windows domain network.

References (3)

Core 3

Core References

Product

https://dradis.com/

Product

https://dradis.com/ce

Third Party Advisory

https://securiteam.io/2025/07/04/cve-2023-50786-dradis-ntlm-theft-vulnerability/

Scores

CVSS v3 4.1

EPSS 0.0023

EPSS Percentile 13.3%

Attack Vector ADJACENT_NETWORK

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-294

Status published

Products (1)

dradisframework/dradis < 4.16.0

Published Jul 05, 2025

Tracked Since Feb 18, 2026