What’s Vulnerable › Vulnerabilities

CVE-2025-23366: Org.jboss.hal:hal-console: wildfly hal console cross-site scripting

• Severity: medium (CVSS 4.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-01-14 · updated 2026-08-19
• Weakness: CWE-79

Description

A flaw was found in the HAL Console in the Wildfly component, which does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output used as a web page that is served to other users. The attacker must be authenticated as a user that belongs to management groups “SuperUser”, “Admin”, or “Maintainer”.

Affected products

• RedHat Hal Management Console: before 3.7.7 — fixed in 3.7.7

How to fix

Upgrade to a fixed version: RedHat Hal Management Console 3.7.7. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2025:10924
• https://access.redhat.com/errata/RHSA-2025:10925
• https://access.redhat.com/errata/RHSA-2025:10926
• https://access.redhat.com/errata/RHSA-2025:10931
• https://access.redhat.com/security/cve/CVE-2025-23366
• https://bugzilla.redhat.com/show_bug.cgi?id=2337619

Get alerted when CVE-2025-23366 or the next vulnerability affects your stack