CVE-2025-23366CWE-79cross-site-scripting

CVE-2025-23366

Medium · published January 14, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
39.0
In the wild
Unconfirmed
What it is

A flaw was found in the HAL Console in the Wildfly component, which does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output used as a web page that is served to other users. The attacker must be authenticated as a user that belongs to management groups “SuperUser”, “Admin”, or “Maintainer”.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00461 · 39.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-01-14T23:16Z
Affected products (1)
ProductVersionsFixed in
redhat/hal_management_console< 3.7.73.7.7
References (6)
https://access.redhat.com/errata/RHSA-2025:10924 · [email protected]https://access.redhat.com/errata/RHSA-2025:10925 · [email protected]https://access.redhat.com/errata/RHSA-2025:10926 · [email protected]https://access.redhat.com/errata/RHSA-2025:10931 · [email protected]https://access.redhat.com/security/cve/CVE-2025-23366 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2337619 · [email protected]
EPSS history
Timeline
  • 14 JAN 17:41Z
    Org.jboss.hal:hal-console: wildfly hal console cross-site scripting
    cvelistv5