CVE-2023-50786

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Dradis through 4.16.0 allows referencing external images (resources) over HTTPS, instead of forcing the use of embedded (uploaded) images. This can be leveraged by an authorized author to attempt to steal the Net-NTLM hashes of other authors on a Windows domain network.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-294

Affected software

Vendor	Product	Versions
dradisframework	Dradis	<= 4.16.0

References

https://dradis.com/Product
https://dradis.com/ceProduct
https://securiteam.io/2025/07/04/cve-2023-50786-dradis-ntlm-theft-vulnerability/Third Party Advisory
https://securiteam.io/2025/07/04/cve-2023-50786-dradis-ntlm-theft-vulnerability/Third Party Advisory

Timeline

Published: Jul 5, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-50797.5Lenovo LeCloud App improper input validation allows attackers to access arbitrary components and arbitrary file downloads, which could resul CVE-2023-50807.8A privilege escalation vulnerability was reported in some Lenovo tablet products that could allow local applications access to device identi CVE-2023-508035.3An issue was discovered in Samsung Mobile Processor, and Modem Exynos 9820, Exynos 9825, Exynos 980, Exynos 990, Exynos 850, Exynos 1080, Ex CVE-2023-508045.3An issue was discovered in Samsung Mobile Processor, and Modem Exynos 9820, Exynos 9825, Exynos 980, Exynos 990, Exynos 850, Exynos 1080, Ex CVE-2023-508058.1A vulnerability was discovered in Samsung Mobile Processor, Wearable Processor, and Modems with versions Exynos 9820, Exynos 9825, Exynos 98 CVE-2023-508068.4A vulnerability was discovered in Samsung Mobile Processor, Wearable Processor, and Modems with versions Exynos 9820, Exynos 9825, Exynos 98 CVE-2023-508078.1A vulnerability was discovered in Samsung Wearable Processor and Modems with versions Exynos 9110, Exynos Modem 5123, Exynos Modem 5300 that CVE-2023-508086.1Zimbra Collaboration before Kepler 9.0.0 Patch 38 GA allows DOM-based JavaScript injection in the Modern UI.CVE-2023-508097.8In certain Sonos products before S1 Release 11.12 and S2 release 15.9, the mt_7615.ko wireless driver does not properly validate an informat CVE-2023-50813.3An information disclosure vulnerability was reported in the Lenovo Tab M8 HD that could allow a local application to gather a non-resettable CVE-2023-508106.0In certain Sonos products before Sonos S1 Release 11.12 and S2 release 15.9, a vulnerability exists in the U-Boot component of the firmware CVE-2023-508116.5An issue discovered in SELESTA Visual Access Manager 4.38.6 allows attackers to modify the “computer” POST parameter related to the ID of a