Security readout for executives and security teams
Plain-English summary
Dradis versions before 4.11.0 may let a logged-in user see job queue details in the Output Console that belong to other users. The disclosed impact is limited information exposure, not data alteration or service outage. Treat this as a confidentiality cleanup issue, especially where Dradis jobs can reference client, assessment, or report activity.
Executive priority
Handle in normal patch governance unless Dradis contains sensitive client or assessment workflows with many users. The impact is confidentiality-only and rated low, but multi-tenant or client-facing assessment environments should prioritize upgrade and access review.
Technical view
The CVE describes improper information exposure in Dradis Output Console job queue visibility. CVSS 3.1 is 3.5 low: network reachable, high complexity, low privileges required, no user interaction, changed scope, low confidentiality impact, and no integrity or availability impact. The bundle identifies CWE-1230 and Dradis before 4.11.0.
Likely exposure
Exposure is most likely in Dradis deployments where multiple authenticated users can access the Output Console. The sources do not identify unauthenticated exposure or broader affected products. Confirm exact deployed Dradis version and role access to console/job queue views.
Exploitation context
The bundle does not cite CISA KEV inclusion or active exploitation. Practical abuse appears to require a valid low-privileged account and conditions allowing visibility into other users' queued jobs. No exploit details should be inferred beyond the stated information disclosure.
Researcher notes
Source evidence is limited. The description states Dradis before 4.11.0, while the affected-version entry in the bundle is not richly detailed. Avoid expanding the product scope. Validate behavior in an authorized test environment and correlate findings with Dradis release information.
Mitigation direction
- Check Dradis vendor guidance and release notes for version 4.11.0 or later.
- Upgrade Dradis instances before 4.11.0 where applicable.
- Restrict Output Console access to users with a clear operational need.
- Review job queue contents for sensitive project or client identifiers.
- Monitor Dradis upstream advisories for corrected affected-version metadata.
Validation and detection
- Inventory Dradis deployments and record exact application versions.
- Identify users and roles with Output Console access.
- Confirm whether job queue entries expose other users' job information.
- Review logs for unusual console access by low-privileged accounts.
- Verify upgraded instances no longer expose cross-user job queue details.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-1230: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-50458 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Low
- CVSS
- 3.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N1.81.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
3.5LowVector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Exposure of Sensitive Information Through Metadata
Exposure of Sensitive Information Through Metadata represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.