{"id":"CVE-2022-23466","aliases":["EUVD-2022-7775","GHSA-xr7p-8q82-878q"],"status":"published","title":"DOM-based cross-site scripting (XSS) in teler dashboard","description":"teler is an real-time intrusion detection and threat alert dashboard. teler prior to version 2.0.0-rc.4 is vulnerable to DOM-based cross-site scripting (XSS) in the teler dashboard. When teler requests messages from the event stream on the `/events` endpoint, the log data displayed on the dashboard are not sanitized. This only affects authenticated users and can only be exploited based on detected threats if the log contains a DOM scripting payload. This vulnerability has been fixed on version `v2.0.0-rc.4`. Users are advised to upgrade. There are no known workarounds for this vulnerability.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00432,"percentile":0.37837,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2022-12-06T15:36:15Z","modified":"2026-10-28T02:30:56Z","fixes":[{"ecosystem":"Go","package":"teler.app","fixed_in":["2.0.0-rc.4","2.0.0-dev.2","0.0.0-20221203202318-20f59eda2420","1.2.3-0.20221203202318-20f59eda2420"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"teler.app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0-rc"},{"last_affected":"2.0.0-rc.3"},{"fixed":"2.0.0-rc.4"}]}]},{"source":"ghsa","ecosystem":"Go","package":"teler.app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0-dev"},{"last_affected":"2.0.0-dev"},{"fixed":"2.0.0-dev.2"}]}],"versions":["2.0.0-dev"]},{"source":"ghsa","ecosystem":"Go","package":"teler.app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.0-20220625162531-2289e90590a9"},{"fixed":"0.0.0-20221203202318-20f59eda2420"}]}]},{"source":"ghsa","ecosystem":"Go","package":"teler.app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.3-0.20220625162531-2289e90590a9"},{"fixed":"1.2.3-0.20221203202318-20f59eda2420"}]}]},{"source":"osv","ecosystem":"Go","package":"teler.app","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0-rc"},{"fixed":"2.0.0-rc.4"}]}]},{"source":"osv","ecosystem":"Go","package":"teler.app","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0-dev"},{"fixed":"2.0.0-dev.2"}]}],"versions":["2.0.0-dev"]},{"source":"osv","ecosystem":"Go","package":"teler.app","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-20220625162531-2289e90590a9"},{"fixed":"0.0.0-20221203202318-20f59eda2420"}]}]},{"source":"osv","ecosystem":"Go","package":"teler.app","ranges":[{"type":"SEMVER","events":[{"introduced":"1.2.3-0.20220625162531-2289e90590a9"},{"fixed":"1.2.3-0.20221203202318-20f59eda2420"}]}]}],"products":[{"vendor":"kitabisa","product":"teler"},{"vendor":"teler_project","product":"teler"}],"references":[{"url":"https://github.com/kitabisa/teler/security/advisories/GHSA-xr7p-8q82-878q","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","advisory","web"]},{"url":"https://github.com/kitabisa/teler/commit/20f59eda2420ac64e29f199a61230a0abc875e8e","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23466","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xr7p-8q82-878q"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23466.json","tags":["advisory"]},{"url":"https://github.com/kitabisa/teler","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-23466","title":"DOM-based cross-site scripting (XSS) in teler dashboard","description":"teler is an real-time intrusion detection and threat alert dashboard. teler prior to version 2.0.0-rc.4 is vulnerable to DOM-based cross-site scripting (XSS) in the teler dashboard. When teler requests messages from the event stream on the `/events` endpoint, the log data displayed on the dashboard are not sanitized. This only affects authenticated users and can only be exploited based on detected threats if the log contains a DOM scripting payload. This vulnerability has been fixed on version `v2.0.0-rc.4`. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2022-12-06T17:58:52.867Z","modified":"2025-04-23T16:32:01.139Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:29.842547Z"}],"euvd":[{"id":"EUVD-2022-7775","description":"teler is an real-time intrusion detection and threat alert dashboard. teler prior to version 2.0.0-rc.4 is vulnerable to DOM-based cross-site scripting (XSS) in the teler dashboard. When teler requests messages from the event stream on the `/events` endpoint, the log data displayed on the dashboard are not sanitized. This only affects authenticated users and can only be exploited based on detected threats if the log contains a DOM scripting payload. This vulnerability has been fixed on version `v2.0.0-rc.4`. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2022-12-06T17:58:52Z","modified":"2025-04-23T16:32:01Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:12.313971Z"}],"ghsa":[{"id":"GHSA-xr7p-8q82-878q","title":"teler dashboard vulnerable to DOM-based cross-site scripting (XSS)","description":"### Description\n\nteler prior to version \u003c= 2.0.0-rc.4 is vulnerable to DOM-based cross-site scripting (XSS) in the teler dashboard. When teler requests messages from the event stream on the `/events` endpoint, the log data displayed on the dashboard are not sanitized.\n\n### Impact\n\nThis only affects authenticated users and can only be exploited based on detected threats if the log contains a DOM scripting payload. This indicates a low severity and there is no significant impact on the users.\n\n### Affected Version\n\nThis issue was introduced from version `v2.0.0-rc` to `v2.0.0-rc.3` \u0026 `v2.0.0-dev`.\n\n### Patches\n\nThis vulnerability has been fixed on version `v2.0.0-rc.4` \u0026 `v2.0.0-dev.2`.\n\n### Workarounds\n\nHere are some workarounds to handle this case:\n- Deactivate the live event dashboard from the configuration file, or\n- Upgrade teler version to `v2.0.0-rc.4` or `v2.0.0-dev.2` \u0026 above.\n\n### References\n\n- https://github.com/kitabisa/teler/commit/20f59eda2420ac64e29f199a61230a0abc875e8e","status":"published","published":"2022-12-06T15:36:15Z","modified":"2025-07-08T19:39:19Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L","level":"low"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:38:49.837727Z"}],"nvd":[{"id":"CVE-2022-23466","description":"teler is an real-time intrusion detection and threat alert dashboard. teler prior to version 2.0.0-rc.4 is vulnerable to DOM-based cross-site scripting (XSS) in the teler dashboard. When teler requests messages from the event stream on the `/events` endpoint, the log data displayed on the dashboard are not sanitized. This only affects authenticated users and can only be exploited based on detected threats if the log contains a DOM scripting payload. This vulnerability has been fixed on version `v2.0.0-rc.4`. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2022-12-06T18:15:09.997Z","modified":"2026-06-17T04:30:10.867Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:33.239526Z"}],"osv":[{"id":"CVE-2022-23466","title":"DOM-based cross-site scripting (XSS) in teler dashboard","description":"teler is an real-time intrusion detection and threat alert dashboard. teler prior to version 2.0.0-rc.4 is vulnerable to DOM-based cross-site scripting (XSS) in the teler dashboard. When teler requests messages from the event stream on the `/events` endpoint, the log data displayed on the dashboard are not sanitized. This only affects authenticated users and can only be exploited based on detected threats if the log contains a DOM scripting payload. This vulnerability has been fixed on version `v2.0.0-rc.4`. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2022-12-06T17:58:52.867Z","modified":"2026-10-28T02:30:56.565507744Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:24.061177Z"},{"id":"GHSA-xr7p-8q82-878q","title":"teler dashboard vulnerable to DOM-based cross-site scripting (XSS)","description":"### Description\n\nteler prior to version \u003c= 2.0.0-rc.4 is vulnerable to DOM-based cross-site scripting (XSS) in the teler dashboard. When teler requests messages from the event stream on the `/events` endpoint, the log data displayed on the dashboard are not sanitized.\n\n### Impact\n\nThis only affects authenticated users and can only be exploited based on detected threats if the log contains a DOM scripting payload. This indicates a low severity and there is no significant impact on the users.\n\n### Affected Version\n\nThis issue was introduced from version `v2.0.0-rc` to `v2.0.0-rc.3` \u0026 `v2.0.0-dev`.\n\n### Patches\n\nThis vulnerability has been fixed on version `v2.0.0-rc.4` \u0026 `v2.0.0-dev.2`.\n\n### Workarounds\n\nHere are some workarounds to handle this case:\n- Deactivate the live event dashboard from the configuration file, or\n- Upgrade teler version to `v2.0.0-rc.4` or `v2.0.0-dev.2` \u0026 above.\n\n### References\n\n- https://github.com/kitabisa/teler/commit/20f59eda2420ac64e29f199a61230a0abc875e8e","status":"published","published":"2022-12-06T15:36:15Z","modified":"2025-07-08T19:39:18Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L","level":"low"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:47:00.198893Z"}]}}