Dradis
Monthly
Server-side request forgery in Dradis Community Edition 5.1.0-5.2.0 allows any authenticated non-admin user to hijack the AI provider configuration and redirect server-initiated HTTP requests to arbitrary URLs, including internal cloud metadata endpoints such as 169.254.169.254. A broken authorization gate in ProvidersController and AgentsController is conditioned on the Ruby constant Dradis::Pro, which is never defined in CE builds, so the admin_required filter is silently skipped for all CE installations. Non-2xx responses from attacker-supplied URLs are reflected verbatim to the attacker's browser via ActionCable/Turbo Stream, enabling exfiltration of internal service content. No public exploit code or CISA KEV listing has been identified at time of analysis.
A security vulnerability in Dradis (CVSS 3.5). Remediation should follow standard vulnerability management procedures.
A remote code execution vulnerability in Dradis through 4.16.0 (CVSS 4.1). Remediation should follow standard vulnerability management procedures.
Dradis before 4.8.0 allows persistent XSS by authenticated author users, related to avatars. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dradis Professional Edition before 4.3.0 allows attackers to change an account password via reusing a password reset token. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Cross-site scripting vulnerability in Dradis Community Edition Dradis Community Edition v3.11 and earlier and Dradis Professional Edition v3.1.1 and earlier allow remote authenticated attackers to. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Server-side request forgery in Dradis Community Edition 5.1.0-5.2.0 allows any authenticated non-admin user to hijack the AI provider configuration and redirect server-initiated HTTP requests to arbitrary URLs, including internal cloud metadata endpoints such as 169.254.169.254. A broken authorization gate in ProvidersController and AgentsController is conditioned on the Ruby constant Dradis::Pro, which is never defined in CE builds, so the admin_required filter is silently skipped for all CE installations. Non-2xx responses from attacker-supplied URLs are reflected verbatim to the attacker's browser via ActionCable/Turbo Stream, enabling exfiltration of internal service content. No public exploit code or CISA KEV listing has been identified at time of analysis.
A security vulnerability in Dradis (CVSS 3.5). Remediation should follow standard vulnerability management procedures.
A remote code execution vulnerability in Dradis through 4.16.0 (CVSS 4.1). Remediation should follow standard vulnerability management procedures.
Dradis before 4.8.0 allows persistent XSS by authenticated author users, related to avatars. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dradis Professional Edition before 4.3.0 allows attackers to change an account password via reusing a password reset token. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Cross-site scripting vulnerability in Dradis Community Edition Dradis Community Edition v3.11 and earlier and Dradis Professional Edition v3.1.1 and earlier allow remote authenticated attackers to. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.