Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 6.5, published 14 January 2025.

Which products and versions are affected?

JBoss HAL Console <= 3.7.7.Final; org.jboss.hal:hal-console (Maven) <= 3.7.7.Final; Red Hat WildFly all versions.

Is there a fix for This vulnerability?

A patch was published on 2025-07-14: Red Hat issued security updates (RHSA-2025:10924, RHSA-2025:10925, RHSA-2025:10926, RHSA-2025:10931) with HAL 3.3.27 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a web application.

Check whether you run JBoss HAL Console, org.jboss.hal:hal-console (Maven) or Red Hat WildFly at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

WildFly HAL Console Cross-Site Scripting

Q: Which products and versions are affected?

JBoss HAL Console <= 3.7.7.Final; org.jboss.hal:hal-console (Maven) <= 3.7.7.Final; Red Hat WildFly all versions.

Q: Is there a fix for This vulnerability?

A patch was published on 2025-07-14: Red Hat issued security updates (RHSA-2025:10924, RHSA-2025:10925, RHSA-2025:10926, RHSA-2025:10931) with HAL 3.3.27 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network, in a web application.

Q: Am I affected?

Check whether you run JBoss HAL Console, org.jboss.hal:hal-console (Maven) or Red Hat WildFly at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: medium · CVSS 6.5 · Published 2025-01-14

WildFly's HAL Console is the web-based management interface used by administrators to configure and monitor application servers. A cross-site scripting vulnerability allows authenticated administrators to inject malicious code that affects other users of the console, risking theft of session credentials or unauthorized administrative actions. Exploitation requires prior authentication with elevated privileges, limiting but not eliminating the risk in multi-user administrative environments.

Technologies: org.jboss.hal:hal-console (Maven), Red Hat WildFly. Vendors: Maven, Red Hat.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 6.5, published 14 January 2025.
Which products and versions are affected?: JBoss HAL Console <= 3.7.7.Final; org.jboss.hal:hal-console (Maven) <= 3.7.7.Final; Red Hat WildFly all versions.
Is there a fix for This vulnerability?: A patch was published on 2025-07-14: Red Hat issued security updates (RHSA-2025:10924, RHSA-2025:10925, RHSA-2025:10926, RHSA-2025:10931) with HAL 3.3.27 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a web application.
Am I affected?: Check whether you run JBoss HAL Console, org.jboss.hal:hal-console (Maven) or Red Hat WildFly at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a stored cross-site scripting (XSS) vulnerability in the HAL Console component (org.jboss.hal:hal-console <= 3.7.7.Final) where user-controllable input is not properly sanitized before being reflected in web page output served to other users. The vulnerability is CWE-79 (Improper Neutralization of Input During Web Page Generation). Attack vector is network-based with high privilege requirements (authenticated users in SuperUser, Admin, or Maintainer groups), no user interaction needed, and results in high impact to confidentiality and integrity. An authenticated attacker can craft payloads to steal session cookies, perform unauthorized administrative actions, or redirect users to malicious sites. The vulnerability affects WildFly and JBoss EAP versions through 7.4.x; patches are available through Red Hat advisories RHSA-2025:10924, RHSA-2025:10925, RHSA-2025:10926, and RHSA-2025:10931 (upgrade to HAL 3.3.27 or later).

Affected products

Red Hat JBoss Enterprise Application Platform 7.4 and earlier
Red Hat WildFly all versions
JBoss HAL Console <= 3.7.7.Final

Timeline

2025-01-14: disclosed
2025-01-14: advisory: GHSA-5wjw-h8x5-v65m published
2025-01-16: other: Advisory withdrawn as duplicate of GHSA-jhvj-f397-8w6q
2025-07-14: patched: Red Hat issued security updates (RHSA-2025:10924, RHSA-2025:10925, RHSA-2025:10926, RHSA-2025:10931) with HAL 3.3.27

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.