GHSA-xr7p-8q82-878q teler dashboard vulnerable to DOM-based cross-site scripting (XSS)

• Go teler.app: >= 2.0.0-rc, < 2.0.0-rc.4 → fixed in 2.0.0-rc.4 • Go teler.app: >= 2.0.0-dev, < 2.0.0-dev.2 → fixed in 2.0.0-dev.2 • Go teler.app: >= 0.0.0-20220625162531-2289e90590a9, < 0.0.0-20221203202318-20f59eda2420 → fixed in 0.0.0-20221203202318-20f59eda2420 • Go teler.app: >= 1.2.3-0.20220625162531-2289e90590a9, < 1.2.3-0.20221203202318-20f59eda2420 → fixed in 1.2.3-0.20221203202318-20f59eda2420

Description teler prior to version <= 2.0.0-rc.4 is vulnerable to DOM-based cross-site scripting (XSS) in the teler dashboard. When teler requests messages from the event stream on the `/events` endpoint, the log data displayed on the dashboard are not sanitized. Impact This only affects authenticated users and can only be exploited based on detected threats if the log contains a DOM scripting payload. This indicates a low severity and there is no significant impact on the users. Affected Version This issue was introduced from version `v2.0.0-rc` to `v2.0.0-rc.3` & `v2.0.0-dev`. Patches This vulnerability has been fixed on version `v2.0.0-rc.4` & `v2.0.0-dev.2`. Workarounds Here are some workarounds to handle this case: • Deactivate the live event dashboard from the configuration file, or • Upgrade teler version to `v2.0.0-rc.4` or `v2.0.0-dev.2` & above. References • https://github.com/kitabisa/teler/commit/20f59eda2420ac64e29f199a61230a0abc875e8e