CVE-2025-23366

MEDIUM

HAL Management Console < 3.7.7 - Authenticated Stored Cross-Site Scripting

Title source: llm
STIX 2.1

Description

A flaw was found in the HAL Console in the Wildfly component, which does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output used as a web page that is served to other users. The attacker must be authenticated as a user that belongs to management groups “SuperUser”, “Admin”, or “Maintainer”.

References (5)

Core 5
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2025:10924
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2025:10925
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2025:10926
Vendor Advisory vdb-entry x_refsource_redhat
https://access.redhat.com/security/cve/CVE-2025-23366
Vendor Advisory issue-tracking x_refsource_redhat
https://bugzilla.redhat.com/show_bug.cgi?id=2337619

Scores

CVSS v3 6.5
EPSS 0.0033
EPSS Percentile 55.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-79
Status published
Products (42)
org.jboss.hal/hal-console 0 - 3.7.7.FinalMaven
Red Hat/Red Hat JBoss Data Grid 7
Red Hat/Red Hat JBoss Enterprise Application Platform 7
Red Hat/Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 0:1.10.0-42.Final_redhat_00042.1.el8eap
Red Hat/Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 0:1.15.26-1.Final_redhat_00001.1.el8eap
Red Hat/Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 0:1.5.21-1.Final_redhat_00001.1.el8eap
Red Hat/Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 0:1.9.6-1.Final_redhat_00001.1.el8eap
Red Hat/Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 0:2.16.0-21.redhat_00055.1.el8eap
Red Hat/Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 0:2.3.14-9.SP10_redhat_00001.1.el8eap
Red Hat/Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 0:3.3.27-1.Final_redhat_00001.1.el8eap
... and 32 more
Published Jan 14, 2025
Tracked Since Feb 18, 2026