DOM-based cross-site scripting (XSS) in teler dashboard
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in v2.0.0-rc.4, 2.0.0-rc.4, 2.0.0-dev.2, 0.0.0-20221203202318-20f59eda2420, 1.2.3-0.20221203202318-20f59eda2420
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
teler is an real-time intrusion detection and threat alert dashboard. teler prior to version 2.0.0-rc.4 is vulnerable to DOM-based cross-site scripting (XSS) in the teler dashboard. When teler requests messages from the event stream on the `/events` endpoint, the log data displayed on the dashboard are not sanitized. This only affects authenticated users and can only be exploited based on detected threats if the log contains a DOM scripting payload. This vulnerability has been fixed on version `v2.0.0-rc.4`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- kitabisa teler
From v2.0.0-rc · fixed in v2.0.0-rc.4
- teler.appGo
From 2.0.0-rc · fixed in 2.0.0-rc.4
- teler.appGo
From 2.0.0-dev · fixed in 2.0.0-dev.2
- teler.appGo
From 0.0.0-20220625162531-2289e90590a9 · fixed in 0.0.0-20221203202318-20f59eda2420
- teler.appGo
From 1.2.3-0.20220625162531-2289e90590a9 · fixed in 1.2.3-0.20221203202318-20f59eda2420