Iris Web
Monthly
Stored cross-site scripting in DFIR-IRIS (iris-web) version 2.4.26 and possibly earlier lets an authenticated, low-privileged user inject persistent JavaScript through the datastore upload function that executes in the browser of any other user who later views the affected datastore content. Because the injected script runs in the security context of victims - including higher-privileged analysts and administrators of the incident-response platform - an attacker can hijack sessions, exfiltrate case data, or perform actions on the victim's behalf. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS 3.1 base score is 7.6 (scope-changed, high confidentiality impact).
Stored cross-site scripting in the DFIR-IRIS incident-response platform (iris-web 2.4.26 and possibly earlier) lets an authenticated low-privileged user inject persistent JavaScript through the custom attributes function, which then executes in the browser of any analyst or administrator who later views the affected record. Because IRIS is a collaborative DFIR case-management tool, a successful payload can hijack higher-privileged sessions and exfiltrate sensitive investigation data. No public exploit identified at time of analysis; the issue was reported by SBA Research (SBA-ADV-20260126-01) and carries a CVSS 3.1 base score of 7.6.
Stored cross-site scripting in the DFIR-IRIS incident-response platform (iris-web 2.4.26 and possibly earlier) lets an authenticated low-privileged user persist malicious JavaScript through the assets function, which then executes in the browser of any other analyst who views the affected case data. Because IRIS holds sensitive investigation material and the CVSS scope is changed (S:C), a successful payload can hijack higher-privileged analyst or administrator sessions. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; disclosure comes from an SBA Research advisory (SBA-ADV-20260126-01).
DFIR-IRIS web application version 2.4.26 implements logout without server-side session invalidation, leaving session cookies valid indefinitely after a user believes they have signed out. Classified as CWE-613 (Insufficient Session Expiration), this flaw means any attacker who obtains a valid session cookie - through XSS, network interception, shoulder-surfing, or physical device access - retains unauthorized access to the IRIS incident response platform even after the legitimate user logs out. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Missing brute-force protection on the DFIR-IRIS web application's authentication endpoint exposes version 2.4.26 (and potentially earlier releases) to unlimited credential-stuffing and password-spraying attacks. Unauthenticated remote attackers can submit an unbounded number of login attempts without triggering rate limiting or account lockout, making weak or reused credentials trivially recoverable. DFIR-IRIS is an incident response platform handling sensitive case data, forensic artifacts, and investigation timelines - successful account compromise gives attackers direct access to that material. No public exploit has been identified at time of analysis, and KEV status is not confirmed.
Missing rate-limiting on MFA validation in DFIR-IRIS 2.4.26 allows a remote attacker who possesses valid user credentials to systematically enumerate multi-factor authentication codes until the correct value is found, bypassing the second authentication factor and gaining unauthorized access to the DFIR investigation platform. The CVSS vector scores High confidentiality impact with no integrity or availability penalty, reflecting full read access to sensitive incident response and forensic investigation data. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog.
Stored cross-site scripting in DFIR-IRIS (iris-web) version 2.4.26 and possibly earlier lets an authenticated, low-privileged user inject persistent JavaScript through the datastore upload function that executes in the browser of any other user who later views the affected datastore content. Because the injected script runs in the security context of victims - including higher-privileged analysts and administrators of the incident-response platform - an attacker can hijack sessions, exfiltrate case data, or perform actions on the victim's behalf. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS 3.1 base score is 7.6 (scope-changed, high confidentiality impact).
Stored cross-site scripting in the DFIR-IRIS incident-response platform (iris-web 2.4.26 and possibly earlier) lets an authenticated low-privileged user inject persistent JavaScript through the custom attributes function, which then executes in the browser of any analyst or administrator who later views the affected record. Because IRIS is a collaborative DFIR case-management tool, a successful payload can hijack higher-privileged sessions and exfiltrate sensitive investigation data. No public exploit identified at time of analysis; the issue was reported by SBA Research (SBA-ADV-20260126-01) and carries a CVSS 3.1 base score of 7.6.
Stored cross-site scripting in the DFIR-IRIS incident-response platform (iris-web 2.4.26 and possibly earlier) lets an authenticated low-privileged user persist malicious JavaScript through the assets function, which then executes in the browser of any other analyst who views the affected case data. Because IRIS holds sensitive investigation material and the CVSS scope is changed (S:C), a successful payload can hijack higher-privileged analyst or administrator sessions. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; disclosure comes from an SBA Research advisory (SBA-ADV-20260126-01).
DFIR-IRIS web application version 2.4.26 implements logout without server-side session invalidation, leaving session cookies valid indefinitely after a user believes they have signed out. Classified as CWE-613 (Insufficient Session Expiration), this flaw means any attacker who obtains a valid session cookie - through XSS, network interception, shoulder-surfing, or physical device access - retains unauthorized access to the IRIS incident response platform even after the legitimate user logs out. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Missing brute-force protection on the DFIR-IRIS web application's authentication endpoint exposes version 2.4.26 (and potentially earlier releases) to unlimited credential-stuffing and password-spraying attacks. Unauthenticated remote attackers can submit an unbounded number of login attempts without triggering rate limiting or account lockout, making weak or reused credentials trivially recoverable. DFIR-IRIS is an incident response platform handling sensitive case data, forensic artifacts, and investigation timelines - successful account compromise gives attackers direct access to that material. No public exploit has been identified at time of analysis, and KEV status is not confirmed.
Missing rate-limiting on MFA validation in DFIR-IRIS 2.4.26 allows a remote attacker who possesses valid user credentials to systematically enumerate multi-factor authentication codes until the correct value is found, bypassing the second authentication factor and gaining unauthorized access to the DFIR investigation platform. The CVSS vector scores High confidentiality impact with no integrity or availability penalty, reflecting full read access to sensitive incident response and forensic investigation data. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog.