A stored cross-site scripting vulnerability in iris-web 2.4.26 poses a significant risk of unauthorized script execution and session compromise for authenticated users.

This vulnerability is a stored cross-site scripting (XSS) flaw caused by improper neutralization of user-supplied input. An authenticated attacker with low privileges can inject malicious scripts that execute within the browser session of other users.

Successful exploitation allows an attacker to perform actions on behalf of other users, potentially including administrative accounts. This could lead to unauthorized data access, session hijacking, or the modification of sensitive incident response data, resulting in severe reputational damage and compromised integrity of the security platform. The CVSS score of 7.6 reflects the high impact on confidentiality and the ability to conduct cross-site scripting attacks.

Immediate Action: Consult the vendor advisory and the provided GitHub repository for patch availability or configuration workarounds to disable the vulnerable input components.

Proactive Monitoring: Monitor application access logs for suspicious input patterns or frequent script-like payloads in form submissions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict XSS filtering rules to inspect and sanitize incoming traffic to the iris-web platform.

Public Exploit Available: Unknown

Given the potential for unauthorized data access and the high severity of XSS in incident response tools, organizations should prioritize restricting access to the iris-web interface. Administrators must apply security updates as soon as they become available to remediate this input validation flaw.