Описание
teler dashboard vulnerable to DOM-based cross-site scripting (XSS)
Description
teler prior to version <= 2.0.0-rc.4 is vulnerable to DOM-based cross-site scripting (XSS) in the teler dashboard. When teler requests messages from the event stream on the /events endpoint, the log data displayed on the dashboard are not sanitized.
Impact
This only affects authenticated users and can only be exploited based on detected threats if the log contains a DOM scripting payload. This indicates a low severity and there is no significant impact on the users.
Affected Version
This issue was introduced from version v2.0.0-rc to v2.0.0-rc.3 & v2.0.0-dev.
Patches
This vulnerability has been fixed on version v2.0.0-rc.4 & v2.0.0-dev.2.
Workarounds
Here are some workarounds to handle this case:
- Deactivate the live event dashboard from the configuration file, or
- Upgrade teler version to
v2.0.0-rc.4orv2.0.0-dev.2& above.
References
Пакеты
teler.app
>= 2.0.0-rc, <= 2.0.0-rc.3
2.0.0-rc.4
teler.app
= 2.0.0-dev
2.0.0-dev.2
teler.app
>= 0.0.0-20220625162531-2289e90590a9, < 0.0.0-20221203202318-20f59eda2420
0.0.0-20221203202318-20f59eda2420
teler.app
>= 1.2.3-0.20220625162531-2289e90590a9, < 1.2.3-0.20221203202318-20f59eda2420
1.2.3-0.20221203202318-20f59eda2420
Связанные уязвимости
teler is an real-time intrusion detection and threat alert dashboard. teler prior to version 2.0.0-rc.4 is vulnerable to DOM-based cross-site scripting (XSS) in the teler dashboard. When teler requests messages from the event stream on the `/events` endpoint, the log data displayed on the dashboard are not sanitized. This only affects authenticated users and can only be exploited based on detected threats if the log contains a DOM scripting payload. This vulnerability has been fixed on version `v2.0.0-rc.4`. Users are advised to upgrade. There are no known workarounds for this vulnerability.