CVE-2022-23466 DOM-based cross-site scripting (XSS) in teler dashboard

What is CVE-2022-23466?

CVE-2022-23466 is a medium-severity cross-site scripting vulnerability in kitabisa teler, published on 6 Dec 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

teler is an real-time intrusion detection and threat alert dashboard. teler prior to version 2.0.0-rc.4 is vulnerable to DOM-based cross-site scripting (XSS) in the teler dashboard. When teler requests messages from the event stream on the `/events` endpoint, the log data displayed on the dashboard are not sanitized. This only affects authenticated users and can only be exploited based on detected threats if the log contains a DOM scripting payload. This vulnerability has been fixed on version `v2.0.0-rc.4`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Weakness: CWE-79

Which versions are affected by CVE-2022-23466?

8 open source packages ship an affected version, including teler.app. It affects 1 product.

Products include Teler Project Teler.

How do I fix CVE-2022-23466?

Upgrade teler.app to a fixed version for your release line: 0.0.0-20221203202318-20f59eda2420, 1.2.3-0.20221203202318-20f59eda2420, 2.0.0-dev.2 or 2.0.0-rc.4.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2022-23466 being exploited?

There is no known exploitation of CVE-2022-23466 in the wild and no public exploit code.

Other vulnerabilities in kitabisa teler

• CVE-2020-26213 Denial of Service in teler Medium 5.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xr7p-8q82-878q.