Veille CVE

Recherche « dfir-iris iris-web »

14 CVE

Critique 0 Élevée 4 Moyenne 10 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « dfir-iris iris-web » ✕
  1. CVE-2026-92605 6.5 Moyenne

    dfir-iris iris-web

    IRIS through 2.4.29 fails to properly validate case authorization in comment listing endpoints for notes, tasks, IOCs, assets, and evidence items. Attackers with access to any single case can enumerate sequential object identifiers and read comment threads from cases they have no authorization to access.

  2. CVE-2026-18362 5.9 Moyenne

    dfir-iris iris-web

    The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks.

  3. CVE-2026-18361 7.6 Élevée

    dfir-iris iris-web

    The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the datastore upload function.

  4. CVE-2026-18360 7.6 Élevée

    dfir-iris iris-web

    The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the custom attributes function.

  5. CVE-2026-16971 5.9 Moyenne

    dfir-iris iris-web

    The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks.

  6. CVE-2026-16970 4.2 Moyenne

    dfir-iris iris-web

    The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies can therefore be misused for a long time.

  7. CVE-2026-16969 7.6 Élevée

    dfir-iris iris-web

    The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the assets function.

  8. CVE-2026-42547 5.4 Moyenne

    dfir-iris iris-web

    IRIS is a web collaborative platform that helps incident responders share technical details during investigations. In versions prior to 2.4.28, users can create alerts for customers that are not assigned to them. This can be abused to falsely attribute fake alerts to customers. In combination with Cross-Site Scripting, this can also be used to exfiltrate alerts from other customers. Version 2.4.28 contains a patch.

  9. CVE-2026-42543 4.3 Moyenne

    dfir-iris iris-web

    IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 are vulnerable to a cross-site request forgery attack, because they use the HTTP method `GET` to change state on the server. Version 2.4.28 contains a patch.

  10. CVE-2026-42540 4.3 Moyenne

    dfir-iris iris-web

    IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 allow a user to alter values in the database via manipulated API requests. Version 2.4.28 contains a patch.

  11. CVE-2026-42539 6.5 Moyenne

    dfir-iris iris-web

    IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 return sensitive data to the user which are not required for the client’s operation. Version 2.4.28 contains a patch.

  12. CVE-2026-42538 6.3 Moyenne

    dfir-iris iris-web

    IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 do not properly validate uploaded files. The application can therefore be misused to host phishing pages, amongst other things. This also creates another instance of a Cross-Site Scripting (XSS) vulnerability. Version 2.4.28 contains a patch.

  13. CVE-2026-42329 4.7 Moyenne

    dfir-iris iris-web

    Iris is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 contain a weakness where an attacker can misuse it to redirect the user to a malicious website controlled by an attacker. Version 2.4.28 fixes the issue.

  14. CVE-2026-41522 7.1 Élevée

    dfir-iris iris-web

    Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to version 2.4.28, DFIR-IRIS exposes an optional GraphQL endpoint at `/graphql` that does not enforce the same authorization checks as the REST API. Any authenticated user can abuse it in three ways: unauthorized IOC read across cases (IDOR), bulk IOC disclosure via `case.iocs`. The `case(caseId: …).iocs` resolver returns IOCs linked to an arbitrary case without verifying the caller has access to that case, and unauthorized case creation. All three are reachable by any authenticated user, regardless of role or case ACL. This is fixed in v2.4.28. The GraphQL blueprint, resolvers, and dependencies (`graphene`, `graphene-sqlalchemy`, `graphql-server[flask]`) were removed entirely, since the feature was not in use. As a workaround, block `/graphql` at the reverse proxy (recommended) or comment out the `graphql_blueprint` import and `register_blueprint` call in `source/app/views.py` and restart.