CVE-2025-23366: HAL Console has a Cross Site Scripting (XSS) vulnerability of user input

January 16, 2025

A flaw was found in the HAL Console in the Wildfly component, which does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output used as a web page that is served to other users. The attacker must be authenticated as a user that belongs to management groups “SuperUser”, “Admin”, or “Maintainer”.

References

access.redhat.com/security/cve/CVE-2025-23366
bugzilla.redhat.com/show_bug.cgi?id=2337619
github.com/advisories/GHSA-jhvj-f397-8w6q
github.com/hal/console
github.com/hal/console/releases/tag/v3.7.7
github.com/hal/console/security/advisories/GHSA-jhvj-f397-8w6q
nvd.nist.gov/vuln/detail/CVE-2025-23366

Code Behaviors & Features

Detect and mitigate CVE-2025-23366 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →