{"id":"GHSA-xr7p-8q82-878q","summary":"teler dashboard vulnerable to DOM-based cross-site scripting (XSS)","details":"### Description\n\nteler prior to version \u003c= 2.0.0-rc.4 is vulnerable to DOM-based cross-site scripting (XSS) in the teler dashboard. When teler requests messages from the event stream on the `/events` endpoint, the log data displayed on the dashboard are not sanitized.\n\n### Impact\n\nThis only affects authenticated users and can only be exploited based on detected threats if the log contains a DOM scripting payload. This indicates a low severity and there is no significant impact on the users.\n\n### Affected Version\n\nThis issue was introduced from version `v2.0.0-rc` to `v2.0.0-rc.3` & `v2.0.0-dev`.\n\n### Patches\n\nThis vulnerability has been fixed on version `v2.0.0-rc.4` & `v2.0.0-dev.2`.\n\n### Workarounds\n\nHere are some workarounds to handle this case:\n- Deactivate the live event dashboard from the configuration file, or\n- Upgrade teler version to `v2.0.0-rc.4` or `v2.0.0-dev.2` & above.\n\n### References\n\n- https://github.com/kitabisa/teler/commit/20f59eda2420ac64e29f199a61230a0abc875e8e","aliases":["CVE-2022-23466"],"modified":"2025-07-08T19:39:18Z","published":"2022-12-06T15:36:15Z","database_specific":{"cwe_ids":["CWE-79"],"severity":"LOW","github_reviewed":true,"github_reviewed_at":"2022-12-06T15:36:15Z","nvd_published_at":"2022-12-06T18:15:00Z"},"references":[{"type":"WEB","url":"https://github.com/kitabisa/teler/security/advisories/GHSA-xr7p-8q82-878q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23466"},{"type":"WEB","url":"https://github.com/kitabisa/teler/commit/20f59eda2420ac64e29f199a61230a0abc875e8e"},{"type":"PACKAGE","url":"https://github.com/kitabisa/teler"}],"affected":[{"package":{"name":"teler.app","ecosystem":"Go","purl":"pkg:golang/teler.app"},"ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0-rc"},{"fixed":"2.0.0-rc.4"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 2.0.0-rc.3","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-xr7p-8q82-878q/GHSA-xr7p-8q82-878q.json"}},{"package":{"name":"teler.app","ecosystem":"Go","purl":"pkg:golang/teler.app"},"ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0-dev"},{"fixed":"2.0.0-dev.2"}]}],"versions":["2.0.0-dev"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-xr7p-8q82-878q/GHSA-xr7p-8q82-878q.json"}},{"package":{"name":"teler.app","ecosystem":"Go","purl":"pkg:golang/teler.app"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-20220625162531-2289e90590a9"},{"fixed":"0.0.0-20221203202318-20f59eda2420"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-xr7p-8q82-878q/GHSA-xr7p-8q82-878q.json"}},{"package":{"name":"teler.app","ecosystem":"Go","purl":"pkg:golang/teler.app"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.2.3-0.20220625162531-2289e90590a9"},{"fixed":"1.2.3-0.20221203202318-20f59eda2420"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-xr7p-8q82-878q/GHSA-xr7p-8q82-878q.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L"}]}