Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1qaHZqLWYzOTctOHc2cc4ABDcS

HAL Console has a Cross Site Scripting (XSS) vulnerability of user input

A flaw was found in the HAL Console in the Wildfly component, which does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output used as a web page that is served to other users. The attacker must be authenticated as a user that belongs to management groups “SuperUser”, “Admin”, or “Maintainer”.

Impact

Cross-site scripting (XSS) vulnerability in the management console.

Patches

Fixed in HAL 3.7.7.Final

Workarounds

No workaround available

References

• https://access.redhat.com/security/cve/CVE-2025-23366
• https://bugzilla.redhat.com/show_bug.cgi?id=2337619

Permalink: https://github.com/advisories/GHSA-jhvj-f397-8w6q
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qaHZqLWYzOTctOHc2cc4ABDcS
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 13 days ago
Updated: 13 days ago

CVSS Score: 6.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

EPSS Percentage: 0.0005
EPSS Percentile: 0.21759

Identifiers: GHSA-jhvj-f397-8w6q, CVE-2025-23366
References:

• https://github.com/hal/console/security/advisories/GHSA-jhvj-f397-8w6q
• https://access.redhat.com/security/cve/CVE-2025-23366
• https://bugzilla.redhat.com/show_bug.cgi?id=2337619
• https://github.com/hal/console/releases/tag/v3.7.7
• https://github.com/advisories/GHSA-jhvj-f397-8w6q

Repository: https://github.com/hal/console
Blast Radius: 10.6

Affected Packages