CVE-2022-23466

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

teler is an real-time intrusion detection and threat alert dashboard. teler prior to version 2.0.0-rc.4 is vulnerable to DOM-based cross-site scripting (XSS) in the teler dashboard. When teler requests messages from the event stream on the `/events` endpoint, the log data displayed on the dashboard are not sanitized. This only affects authenticated users and can only be exploited based on detected threats if the log contains a DOM scripting payload. This vulnerability has been fixed on version `v2.0.0-rc.4`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
kitabisa	teler	>= v2.0.0-rc, < v2.0.0-rc.4; = v2.0.0-dev

References

https://github.com/kitabisa/teler/commit/20f59eda2420ac64e29f199a61230a0abc875e8ePatch, Third Party Advisory
https://github.com/kitabisa/teler/security/advisories/GHSA-xr7p-8q82-878qPatch, Third Party Advisory
https://github.com/kitabisa/teler/commit/20f59eda2420ac64e29f199a61230a0abc875e8ePatch, Third Party Advisory
https://github.com/kitabisa/teler/security/advisories/GHSA-xr7p-8q82-878qPatch, Third Party Advisory

Timeline

Published: Dec 6, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-234674.6OpenRazer is an open source driver and user-space daemon to control Razer device lighting and other features on GNU/Linux. Using a modified CVE-2022-234689.8xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.CVE-2022-234696.5Traefik is an open source HTTP reverse proxy and load balancer. Versions prior to 2.9.6 are subject to a potential vulnerability in Traefik CVE-2022-23477.1There exists an unchecked length field in UBoot. The U-Boot DFU implementation does not bound the length field in USB DFU download setup pac CVE-2022-234707.5Galaxy is an open-source platform for data analysis. An arbitrary file read exists in Galaxy 22.01 and Galaxy 22.05 due to the switch to Gun CVE-2022-234716.5containerd is an open source container runtime. A bug was found in containerd's CRI implementation where a user can exhaust memory on the ho CVE-2022-234727.5Passeo is an open source python password generator. Versions prior to 1.0.5 rely on the python `random` library for random value selection. CVE-2022-234734.3Tuleap is an Open Source Suite to improve management of software developments and collaboration. In versions prior to 14.2.99.148, Authoriza CVE-2022-234746.1Editor.js is a block-style editor with clean JSON output. Versions prior to 2.26.0 are vulnerable to Code Injection via pasted input. The pr CVE-2022-234758.8daloRADIUS is an open source RADIUS web management application. daloRadius 1.3 and prior are vulnerable to a combination cross site scriptin CVE-2022-234767.5Nokogiri is an open source XML and HTML library for the Ruby programming language. Nokogiri `1.13.8` and `1.13.9` fail to check the return v CVE-2022-234779.8xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.