« Volver al listado

CVE-2026-42329

Estado: AplazadaMedia (4.7)—

Iris is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 contain a weakness where an attacker can misuse it to redirect the user to a malicious website controlled by an attacker. Version 2.4.28 fixes the issue.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Iris — IrisAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-42329",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-42329",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-08T15:10:29.661218Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 4.7,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "dfir-iris",
          "product": "iris-web",
          "versions": [
            {
              "status": "affected",
              "version": "< 2.4.28"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-06-04T21:16:30.563",
  "references": [
    {
      "url": "https://github.com/dfir-iris/iris-web/security/advisories/GHSA-vjc3-7jwv-j9qf",
      "source": "security-advisories@github.com"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/05/19/7",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/dfir-iris/iris-web/security/advisories/GHSA-vjc3-7jwv-j9qf",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-602"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Iris is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 contain a weakness where an attacker can misuse it to redirect the user to a malicious website controlled by an attacker. Version 2.4.28 fixes the issue."
    },
    {
      "lang": "es",
      "value": "Iris es una plataforma web colaborativa que ayuda a los respondedores de incidentes a compartir detalles técnicos durante las investigaciones. Las versiones anteriores a la 2.4.28 contienen una debilidad donde un atacante puede hacer un uso indebido de ella para redirigir al usuario a un sitio web malicioso controlado por un atacante. La versión 2.4.28 soluciona el problema."
    }
  ],
  "lastModified": "2026-07-22T20:10:00.127",
  "sourceIdentifier": "security-advisories@github.com"
}