CVE-2024-25624

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. Due to an improper setup of Jinja2 environment, reports generation in `iris-web` is prone to a Server Side Template Injection (SSTI). Successful exploitation of the vulnerability can lead to an arbitrary Remote Code Execution. An authenticated administrator has to upload a crafted report template containing the payload. Upon generation of a report based on the weaponized report, any user can trigger the vulnerability. The vulnerability is patched in IRIS v2.4.6. No workaround is available. It is recommended to update as soon as possible. Until patching, review the report templates and keep the administrative privileges that include the upload of report templates limited to dedicated users.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1336 CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Apr 25, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-256259.3Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. A potential security vulnerability has been discovered in `pimcore/admin-u CVE-2024-256269.8Yocto Project is an open source collaboration project that helps developers create custom Linux-based systems regardless of the hardware arc CVE-2024-256274.8Alf.io is a free and open source event attendance management system. An administrator on the alf.io application is able to upload HTML files CVE-2024-256287.6Alf.io is a free and open source event attendance management system. In versions prior to 2.0-M4-2402 users can access the admin area even a CVE-2024-256295.5c-ares is a C library for asynchronous DNS requests. `ares__read_line()` is used to parse local configuration files such as `/etc/resolv.con CVE-2024-25639.8A vulnerability has been found in PandaXGO PandaX up to 20240310 and classified as critical. This vulnerability affects the function DeleteI CVE-2024-256305.3Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who are using CRDs to store Cili CVE-2024-256315.3Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who have enabled an external kvs CVE-2024-256328.8eLabFTW is an open source electronic lab notebook for research labs. In the context of eLabFTW, an administrator is a user account with cert CVE-2024-256335.4eLabFTW is an open source electronic lab notebook for research labs. In an eLabFTW system, one can configure who is allowed to create new us CVE-2024-256346.5alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, an attacker can access data from other organizers. The att CVE-2024-256358.8alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, organization owners can view the generated API KEY and USE