Dradis
CVE-2022-30028
MEDIUM
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
Dradis Professional Edition before 4.3.0 allows attackers to change an account password via reusing a password reset token.
AnalysisAI
Dradis Professional Edition before 4.3.0 allows attackers to change an account password via reusing a password reset token. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-362. Dradis Professional Edition before 4.3.0 allows attackers to change an account password via reusing a password reset token. Affected products include: Dradisframework Dradis. Version information: before 4.3.0.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
Server-side request forgery in Dradis Community Edition 5.1.0-5.2.0 allows any authenticated non-admin user to hijack th
Dradis before 4.8.0 allows persistent XSS by authenticated author users, related to avatars. Rated medium severity (CVSS
Cross-site scripting vulnerability in Dradis Community Edition Dradis Community Edition v3.11 and earlier and Dradis Pro
A remote code execution vulnerability in Dradis through 4.16.0 (CVSS 4.1). Remediation should follow standard vulnerabil
A security vulnerability in Dradis (CVSS 3.5). Remediation should follow standard vulnerability management procedures.
Same weakness CWE-362 – Race Condition
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today