CVE-2024-25640 - CVE House
Back to Database
Status published Medium CVE-2024-25640

Improper Neutralization of Alternate XSS Syntax in iris-web

Vulnerability Description

Iris is a web collaborative platform that helps incident responders share technical details during investigations. A stored Cross-Site Scripting (XSS) vulnerability has been identified in iris-web, affecting multiple locations in versions prior to v2.4.0. The vulnerability may allow an attacker to inject malicious scripts into the application, which could then be executed when a user visits the affected locations. This could lead to unauthorized access, data theft, or other related malicious activities. An attacker need to be authenticated on the application to exploit this vulnerability. The issue is fixed in version v2.4.0 of iris-web. No workarounds are available.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-25640

Credits & Attribution

No credits recorded in the NVD database.

References

More from dfir-iris

View All →
CVE-2024-34060
Arbitrary File Write in IRIS EVTX Pipeline
High 8.8
CVE-2024-25624
iris-web vulnerable to Server Side Template Injection in reports
Medium 6.8
CVE-2023-50712
Improper Neutralization of Alternate XSS Syntax in iris-web
Medium 4.6
CVE-2023-30615
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in iris-web
Medium 6.3

Affected Vendor

Affected Software

iris-web
Vulnerable Versions:
< 2.4.0

Timeline

Official Publish: February 19th, 2024
Last Modified: August 1st, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Weaknesses (CWE)

CWE-87

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.