CVE-2025-23366
Medium
Description
A flaw was found in the HAL Console in the Wildfly component, which does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output used as a web page that is served to other users. The attacker must be authenticated as a user that belongs to management groups “SuperUser”, “Admin”, or “Maintainer”.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Redhat Hal Management Console
PublishedJan 14, 2025
First seenJan 14, 2025
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- redhat hal_management_console3.7.7 or later
- org.jboss.hal:hal-console3.7.7.Final or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat hal_management_console | v < 3.7.7 | 3.7.7 |
| org.jboss.hal:hal-consoleMaven | v < 3.7.7.Final | 3.7.7.Final |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.