CVE-2023-30615— Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in iris-web
Quick assessment
Affected
dfir-iris iris-web
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Iris是一个快速、简单但功能齐全且非常高效的 Go 网络框架。 Iris 2.2.1之前版本存在安全漏洞，该漏洞源于存在存储型跨站脚本(XSS)漏洞，允许攻击者将恶意脚本注入应用程序，可能导致未经授权的访问、数据窃取或其他恶意活动。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-30615
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in iris-web
Source: CVE Program / CVE List V5
Vulnerability Description
Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. A stored Cross-Site Scripting (XSS) vulnerability has been identified in iris-web, affecting multiple locations . The vulnerability in allows an attacker to inject malicious scripts into the application, which are then executed when a user visits the affected locations. This can lead to unauthorized access, data theft, or other malicious activities. An attacker need to be authenticated on the application to exploit this vulnerability. The issue was patched in version 2.2.1 of iris-web.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
Web页面中脚本相关HTML标签转义处理不恰当(基本跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
Iris 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Iris是一个快速、简单但功能齐全且非常高效的 Go 网络框架。 Iris 2.2.1之前版本存在安全漏洞，该漏洞源于存在存储型跨站脚本(XSS)漏洞，允许攻击者将恶意脚本注入应用程序，可能导致未经授权的访问、数据窃取或其他恶意活动。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2023-30615
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-30615
请登录查看更多情报信息。
Vendor Advisories for CVE-2023-30615 (1)
-
https://github.com/dfir-iris/iris-web/security/advisories/GHSA-gc6j-6276-2m49 x_refsource_CONFIRM
Other References for CVE-2023-30615 (1)
-
https://github.com/dfir-iris/iris-web/releases/tag/v2.2.1 x_refsource_MISC
IV. Related Vulnerabilities
Same product: iris-web
-
CVE-2026-16970
DFIR-IRIS Insufficient Logout Implementation -
CVE-2026-18362
DFIR-IRIS Missing Brute Force Protection in User Authenticat -
CVE-2026-16971
DFIR-IRIS Missing Brute Force Protection in OTP Validation -
CVE-2026-18361
DFIR-IRIS Stored XSS in Datastore Upload -
CVE-2026-18360
DFIR-IRIS Stored XSS in Custom Attributes
Same vendor: dfir-iris
-
CVE-2026-16970
DFIR-IRIS Insufficient Logout Implementation -
CVE-2026-18362
DFIR-IRIS Missing Brute Force Protection in User Authenticat -
CVE-2026-16971
DFIR-IRIS Missing Brute Force Protection in OTP Validation -
CVE-2026-18361
DFIR-IRIS Stored XSS in Datastore Upload -
CVE-2026-18360
DFIR-IRIS Stored XSS in Custom Attributes
Same weakness: CWE-80
-
CVE-2026-5389
justhtml before 1.13.0 XSS via code fence breakout -
CVE-2026-35163
OctoPrint: XSS in Suppressed Command Notifications -
CVE-2026-73220
CVAT: Stored XSS via annotation guides in audio tasks -
CVE-2026-20232
Cisco Industrial Ethernet 1000 Series Switches Stored Cross- -
CVE-2026-54570
AngleSharp: HTML5 Spec Compliance: mXSS via annotation-xml H
V. Comments for CVE-2023-30615
No comments yet