CVE-2026-42543 Details
Description
IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 are vulnerable to a cross-site request forgery attack, because they use the HTTP method `GET` to change state on the server. Version 2.4.28 contains a patch.
A cross-site request forgery (CSRF) vulnerability has been identified in the IRIS web application, specifically in versions prior to 2.4.28. This vulnerability arises because the application uses the HTTP GET method to change state on the server, which can be exploited by users with active sessions. The issue allows for unintended actions to be performed, such as rotating an API token or logging out of the session.
Users are advised to update to IRIS version 2.4.28 or later. Additionally, the application should be configured to accept parameters only via the POST method when POST is the default, and GET requests should not cause any state changes on the server.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 4, 2026CISA-ADP
Assessed Jun 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dfir-iris/iris-web/security/advisories/GHSA-m73w-v4r5-vw9m | CISA-ADP | AdvisoryExploitRemedyVendor |
| http://www.openwall.com/lists/oss-security/2026/05/19/11 | CVE | AdvisoryMailing ListRemedy |
| https://github.com/dfir-iris/iris-web/security/advisories/GHSA-m73w-v4r5-vw9m | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-650 | Trusting HTTP Permission Methods on the Server Side | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| DFIR-IRIS | <= 2.4.27 (semver) |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 8, 2026 | CVE Modified | CISA-ADP |
| Jun 4, 2026 | New CVE Received | [email protected] |
| Jun 4, 2026 | CVE Modified | CVE |