CVE-2022-23466
teler dashboard vulnerable to DOM-based cross-site scripting (XSS)
Impact
### Description teler prior to version <= 2.0.0-rc.4 is vulnerable to DOM-based cross-site scripting (XSS) in the teler dashboard. When teler requests messages from the event stream on the `/events` endpoint, the log data displayed on the dashboard are not sanitized. ### Impact This only affects authenticated users and can only be exploited based on detected threats if the log contains a DOM scripting payload. This indicates a low severity and there is no significant impact on the users. ### Affected Version This issue was introduced from version `v2.0.0-rc` to `v2.0.0-rc.3` & `v2.0.0-dev`. ### Patches This vulnerability has been fixed on version `v2.0.0-rc.4` & `v2.0.0-dev.2`. ### Workarounds Here are some workarounds to handle this case: - Deactivate the live event dashboard from the configuration file, or - Upgrade teler version to `v2.0.0-rc.4` or `v2.0.0-dev.2` & above. ### References - https://github.com/kitabisa/teler/commit/20f59eda2420ac64e29f199a61230a0abc875e8e
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | teler.app | >= 2.0.0-rc, <= 2.0.0-rc.3 | 2.0.0-rc.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Teler Project | Teler | Version 2.0.0 |