Read the docs
TI-2025-17141 Aliases CVE-2025-23366GHSA-jhvj-f397-8w6q

Org.jboss.hal:hal-console: wildfly hal console cross-site scripting

Priority LOW 31CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 1 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.

Summary

A flaw was found in the HAL Console in the Wildfly component, which does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output used as a web page that is served to other users. The attacker must be authenticated as a user that belongs to management groups “SuperUser”, “Admin”, or “Maintainer”.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00461 40th percentileScored 2026-11-07
Fix Partial hal-console: 3.7.7.Finalorg.jboss.hal:hal-console (Maven): 3.7.7.FinalRed Hat: 4 advisoriesRed Hat: 1 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—hal-consolebefore 3.7.7.Final3.7.7.FinalPatch availableCNA
Red HatRed Hat JBoss Enterprise Application Platform 7——Not affectedCNA
Red HatRed Hat JBoss Data Grid 7——No fix listedCNA
Red HatRed Hat JBoss Enterprise Application Platform 7——Not affectedCNA
Red HatRed Hat JBoss Enterprise Application Platform 8——No fix listedCNA
Red HatRed Hat JBoss Enterprise Application Platform Expansion Pack——Not affectedCNA
—org.jboss.hal:hal-console (Maven)before 3.7.7.Final3.7.7.FinalPatch availableGHSA-jhvj-f397-8w6q
  • hal-console Vendor— Affected before 3.7.7.Final Fixed in 3.7.7.Final Patch available CNA
  • Red Hat JBoss Enterprise Application Platform 7 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat JBoss Data Grid 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat JBoss Enterprise Application Platform 7 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat JBoss Enterprise Application Platform 8 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat JBoss Enterprise Application Platform Expansion Pack VendorRed Hat Affected — Fixed in — Not affected CNA
  • org.jboss.hal:hal-console (Maven) Vendor— Affected before 3.7.7.Final Fixed in 3.7.7.Final Patch available GHSA-jhvj-f397-8w6q

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:redhat:hal_management_console:*:*:*:*:*:*:*:*before 3.7.7VulnerableRed Hat
  • cpe:2.3:a:redhat:hal_management_console:*:*:*:*:*:*:*:* Versions before 3.7.7 Vulnerable ·Red Hat

Remediation

  • Fix · CNA hal-console Fixed in 3.7.7.Final
  • Fix · GHSA-jhvj-f397-8w6q org.jboss.hal:hal-console (Maven) Fixed in 3.7.7.Final Advisory →

Red Hat 4 advisories

  • RHSA-2025:10931 Released 2025-07-14 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.23 Security update
    • Red Hat JBoss Enterprise Application Platform 7
  • RHSA-2025:10925 Released 2025-07-14 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.23 Security update
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-activemq-artemis-2.16.0-21.redhat_00055.1.el8eap, eap7-activemq-artemis-cli-2.16.0-21.redhat_00055.1.el8eap, eap7-activemq-artemis-commons-2.16.0-21.redhat_00055.1.el8eap +46
  • RHSA-2025:10924 Released 2025-07-14 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.23 Security update
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-activemq-artemis-2.16.0-21.redhat_00055.1.el7eap, eap7-activemq-artemis-cli-2.16.0-21.redhat_00055.1.el7eap, eap7-activemq-artemis-commons-2.16.0-21.redhat_00055.1.el7eap +45
Show 1 more Red Hat advisories
  • RHSA-2025:10926 Released 2025-07-14 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.23 Security update
    • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-activemq-artemis-2.16.0-21.redhat_00055.1.el9eap, eap7-activemq-artemis-cli-2.16.0-21.redhat_00055.1.el9eap, eap7-activemq-artemis-commons-2.16.0-21.redhat_00055.1.el9eap +46

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 8AffectedNo fix yet: Fix deferred
Red Hat JBoss Enterprise Application Platform 7Fixed RHSA-2025:10931
Not affected: 2 products
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform Expansion Pack

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-23366
  2. 2026-10-03 Alias added: GHSA-jhvj-f397-8w6q

References

Advisory 6

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences