Description
teler is an real-time intrusion detection and threat alert dashboard. teler prior to version 2.0.0-rc.4 is vulnerable to DOM-based cross-site scripting (XSS) in the teler dashboard. When teler requests messages from the event stream on the `/events` endpoint, the log data displayed on the dashboard are not sanitized. This only affects authenticated users and can only be exploited based on detected threats if the log contains a DOM scripting payload. This vulnerability has been fixed on version `v2.0.0-rc.4`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
References (2)
Core 2
Core References
Patch, Third Party Advisory x_refsource_confirm
https://github.com/kitabisa/teler/security/advisories/GHSA-xr7p-8q82-878q
Patch, Third Party Advisory x_refsource_misc
https://github.com/kitabisa/teler/commit/20f59eda2420ac64e29f199a61230a0abc875e8e
Scores
CVSS v3
5.4
EPSS
0.0021
EPSS Percentile
43.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-79
Status
published
Products (2)
Go/teler.app
2.0.0-rc - 2.0.0-rc.4Go
teler_project/teler
2.0.0 dev (4 CPE variants)
Published
Dec 06, 2022
Tracked Since
Feb 18, 2026