CVE-2023-50712: dfir-iris iris

csirt@kutim:~/threat-intel/cve/CVE-2023-50712

CVSS 5.4 · Medium EPSS 0,30%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada dfir-iris iris. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. A stored Cross-Site Scripting (XSS) vulnerability has been identified in iris-web, affecting multiple locations in versions prior to v2.3.7. The vulnerability may allow an attacker to inject malicious scripts into the application, which could then be executed when a user visits the affected locations. This could lead to unauthorized access, data theft, or other related malicious activities. An attacker need to be authenticated on the application to exploit this vulnerability. The issue is fixed in version v2.3.7 of iris-web. No known workarounds are available.

Rincian

Terbit di NVD: 22 Desember 2023
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-87: Improper Neutralization of Alternate XSS Syntax
EPSS (30 hari): 0,30% peluang dieksploitasi; lebih tinggi dari 20,8% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
dfir-iris	iris	Semua versi sebelum 2.3.7

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/dfir-iris/iris-web/security/advisories/GHSA-593r-747g-p92p advisory vendor
https://github.com/dfir-iris/iris-web/releases/tag/v2.3.7 release notes

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.