| Package | Affected versions | Patched versions |
|---|---|---|
| teler.app | ≥ 0.0.0-20220625162531-2289e90590a9, < 0.0.0-20221203202318-20f59eda2420≥ 1.2.3-0.20220625162531-2289e90590a9, < 1.2.3-0.20221203202318-20f59eda2420≥ 2.0.0-dev, < 2.0.0-dev.2≥ 2.0.0-rc, < 2.0.0-rc.4 | 0.0.0-20221203202318-20f59eda24201.2.3-0.20221203202318-20f59eda24202.0.0-dev.22.0.0-rc.4 |
| teler | = 2.0.0 |
teler prior to version <= 2.0.0-rc.4 is vulnerable to DOM-based cross-site scripting (XSS) in the teler dashboard. When teler requests messages from the event stream on the /events endpoint, the log data displayed on the dashboard are not sanitized.
This only affects authenticated users and can only be exploited based on detected threats if the log contains a DOM scripting payload. This indicates a low severity and there is no significant impact on the users.
This issue was introduced from version v2.0.0-rc to v2.0.0-rc.3 & v2.0.0-dev.
This vulnerability has been fixed on version v2.0.0-rc.4 & v2.0.0-dev.2.
Here are some workarounds to handle this case:
v2.0.0-rc.4 or v2.0.0-dev.2 & above.Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free