CVE-2022-23466
DOM-based cross-site scripting (XSS) in teler dashboard
teler is an real-time intrusion detection and threat alert dashboard. teler prior to version 2.0.0-rc.4 is vulnerable to DOM-based cross-site scripting (XSS) in the teler dashboard. When teler requests messages from the event stream on the /events endpoint, the log data displayed on the dashboard are not sanitized. This only affects authenticated users and can only be exploited based on detected threats if the log contains a DOM scripting payload. This vulnerability has been fixed on version v2.0.0-rc.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
DOM-based cross-site scripting (XSS) in teler dashboard
teler is an real-time intrusion detection and threat alert dashboard. teler prior to version 2.0.0-rc.4 is vulnerable to DOM-based cross-site scripting (XSS) in the teler dashboard. When teler requests messages from the event stream on the /events endpoint, the log data displayed on the dashboard are not sanitized. This only affects authenticated users and can only be exploited based on detected threats if the log contains a DOM scripting payload. This vulnerability has been fixed on version v2.0.0-rc.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2022-23466- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2022-7775
teler is an real-time intrusion detection and threat alert dashboard. teler prior to version 2.0.0-rc.4 is vulnerable to DOM-based cross-site scripting (XSS) in the teler dashboard. When teler requests messages from the event stream on the /events endpoint, the log data displayed on the dashboard are not sanitized. This only affects authenticated users and can only be exploited based on detected threats if the log contains a DOM scripting payload. This vulnerability has been fixed on version v2.0.0-rc.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
EUVD-2022-7775- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-xr7p-8q82-878q
teler dashboard vulnerable to DOM-based cross-site scripting (XSS)
Description
teler prior to version <= 2.0.0-rc.4 is vulnerable to DOM-based cross-site scripting (XSS) in the teler dashboard. When teler requests messages from the event stream on the /events endpoint, the log data displayed on the dashboard are not sanitized.
Impact
This only affects authenticated users and can only be exploited based on detected threats if the log contains a DOM scripting payload. This indicates a low severity and there is no significant impact on the users.
Affected Version
This issue was introduced from version v2.0.0-rc to v2.0.0-rc.3 & v2.0.0-dev.
Patches
This vulnerability has been fixed on version v2.0.0-rc.4 & v2.0.0-dev.2.
Workarounds
Here are some workarounds to handle this case:
- Deactivate the live event dashboard from the configuration file, or
- Upgrade teler version to
v2.0.0-rc.4orv2.0.0-dev.2& above.
References
- Record
GHSA-xr7p-8q82-878q- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
teler is an real-time intrusion detection and threat alert dashboard. teler prior to version 2.0.0-rc.4 is vulnerable to DOM-based cross-site scripting (XSS) in the teler dashboard. When teler requests messages from the event stream on the /events endpoint, the log data displayed on the dashboard are not sanitized. This only affects authenticated users and can only be exploited based on detected threats if the log contains a DOM scripting payload. This vulnerability has been fixed on version v2.0.0-rc.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2022-23466- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
DOM-based cross-site scripting (XSS) in teler dashboard
teler is an real-time intrusion detection and threat alert dashboard. teler prior to version 2.0.0-rc.4 is vulnerable to DOM-based cross-site scripting (XSS) in the teler dashboard. When teler requests messages from the event stream on the /events endpoint, the log data displayed on the dashboard are not sanitized. This only affects authenticated users and can only be exploited based on detected threats if the log contains a DOM scripting payload. This vulnerability has been fixed on version v2.0.0-rc.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2022-23466- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-xr7p-8q82-878q
teler dashboard vulnerable to DOM-based cross-site scripting (XSS)
Description
teler prior to version <= 2.0.0-rc.4 is vulnerable to DOM-based cross-site scripting (XSS) in the teler dashboard. When teler requests messages from the event stream on the /events endpoint, the log data displayed on the dashboard are not sanitized.
Impact
This only affects authenticated users and can only be exploited based on detected threats if the log contains a DOM scripting payload. This indicates a low severity and there is no significant impact on the users.
Affected Version
This issue was introduced from version v2.0.0-rc to v2.0.0-rc.3 & v2.0.0-dev.
Patches
This vulnerability has been fixed on version v2.0.0-rc.4 & v2.0.0-dev.2.
Workarounds
Here are some workarounds to handle this case:
- Deactivate the live event dashboard from the configuration file, or
- Upgrade teler version to
v2.0.0-rc.4orv2.0.0-dev.2& above.
References
- Record
GHSA-xr7p-8q82-878q- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
teler.appGo |
2.0.0-rc to 2.0.0-rc.3 | 2.0.0-rc.4 |
teler.appGo |
2.0.0-dev to 2.0.0-dev | 2.0.0-dev.2 |
teler.appGo |
0.0.0-20220625162531-2289e90590a9 up to 0.0.0-20221203202318-20f59eda2420 | 0.0.0-20221203202318-20f59eda2420 |
teler.appGo |
1.2.3-0.20220625162531-2289e90590a9 up to 1.2.3-0.20221203202318-20f59eda2420 | 1.2.3-0.20221203202318-20f59eda2420 |
teler.appGo |
2.0.0-rc up to 2.0.0-rc.4 | 2.0.0-rc.4 |
teler.appGo |
2.0.0-dev up to 2.0.0-dev.2 | 2.0.0-dev.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-23466 is a medium vulnerability (CVSS 5.4) in Kitabisa Teler, published December 6, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.42%, the 36th percentile. Fixed in teler.app 2.0.0-rc.4.
References
github.com/kitabisa/teler/security/advisories/GHSA-xr7p-8q82-878q
nvd.nist.gov/vuln/detail/CVE-2022-23466