Read the docs
TI-2024-16868 Aliases CVE-2024-25640

Improper Neutralization of Alternate XSS Syntax in iris-web

Priority LOW 24CWE-87Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Iris is a web collaborative platform that helps incident responders share technical details during investigations. A stored Cross-Site Scripting (XSS) vulnerability has been identified in iris-web, affecting multiple locations in versions prior to v2.4.0. The vulnerability may allow an attacker to inject malicious scripts into the application, which could then be executed when a user visits the affected locations. This could lead to unauthorized access, data theft, or other related malicious activities. An attacker need to be authenticated on the application to exploit this vulnerability. The issue is fixed in version v2.4.0 of iris-web. No workarounds are available.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00337 27th percentileScored 2026-11-07
Fix Fixed iris-web (dfir-iris): 2.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
dfir-irisiris-webbefore 2.4.02.4.0Patch availableCNA
  • iris-web Vendordfir-iris Affected before 2.4.0 Fixed in 2.4.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:dfir-iris:iris:*:*:*:*:*:*:*:*before 2.4.0Vulnerabledfir-iris
  • cpe:2.3:a:dfir-iris:iris:*:*:*:*:*:*:*:* Versions before 2.4.0 Vulnerable ·dfir-iris

Remediation

  • Fix · CNA iris-web (dfir-iris) Fixed in 2.4.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-25640

References

Advisory 1

  • TI-2026-18301 Iris Allows Arbitrary File Deletion via Mass Assignment in Datastore File Management CVSS 3.1CRITICAL 9.6
  • TI-2024-16852 iris-web vulnerable to Server Side Template Injection in reports CVSS 3.1MEDIUM 6.8
  • TI-2023-14431 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in iris-web CVSS 3.1MEDIUM 6.3
  • TI-2023-27658 Improper Neutralization of Alternate XSS Syntax in iris-web CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences