# WildFly HAL Console Cross-Site Scripting

Source: https://junglewise.ai/threats/wildfly-hal-console-cross-site-scripting-4d3e033e  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-01-14. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 6.5 · Published 2025-01-14

WildFly's HAL Console is the web-based management interface used by administrators to configure and monitor application servers. A cross-site scripting vulnerability allows authenticated administrators to inject malicious code that affects other users of the console, risking theft of session credentials or unauthorized administrative actions. Exploitation requires prior authentication with elevated privileges, limiting but not eliminating the risk in multi-user administrative environments.

Technologies: [org.jboss.hal:hal-console (Maven)](https://junglewise.ai/threats/technologies/org-jboss-hal-hal-console), [Red Hat WildFly](https://junglewise.ai/threats/technologies/wildfly). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 6.5, published 14 January 2025.

**Which products and versions are affected?** JBoss HAL Console <= 3.7.7.Final; org.jboss.hal:hal-console (Maven) <= 3.7.7.Final; Red Hat WildFly all versions.

**Is there a fix for This vulnerability?** A patch was published on 2025-07-14: Red Hat issued security updates (RHSA-2025:10924, RHSA-2025:10925, RHSA-2025:10926, RHSA-2025:10931) with HAL 3.3.27 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a web application.

**Am I affected?** Check whether you run JBoss HAL Console, org.jboss.hal:hal-console (Maven) or Red Hat WildFly at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a stored cross-site scripting (XSS) vulnerability in the HAL Console component (org.jboss.hal:hal-console <= 3.7.7.Final) where user-controllable input is not properly sanitized before being reflected in web page output served to other users. The vulnerability is CWE-79 (Improper Neutralization of Input During Web Page Generation). Attack vector is network-based with high privilege requirements (authenticated users in SuperUser, Admin, or Maintainer groups), no user interaction needed, and results in high impact to confidentiality and integrity. An authenticated attacker can craft payloads to steal session cookies, perform unauthorized administrative actions, or redirect users to malicious sites. The vulnerability affects WildFly and JBoss EAP versions through 7.4.x; patches are available through Red Hat advisories RHSA-2025:10924, RHSA-2025:10925, RHSA-2025:10926, and RHSA-2025:10931 (upgrade to HAL 3.3.27 or later).

## Affected products

- Red Hat JBoss Enterprise Application Platform 7.4 and earlier
- Red Hat WildFly all versions
- JBoss HAL Console <= 3.7.7.Final

## Timeline

- 2025-01-14: disclosed
- 2025-01-14: advisory: GHSA-5wjw-h8x5-v65m published
- 2025-01-16: other: Advisory withdrawn as duplicate of GHSA-jhvj-f397-8w6q
- 2025-07-14: patched: Red Hat issued security updates (RHSA-2025:10924, RHSA-2025:10925, RHSA-2025:10926, RHSA-2025:10931) with HAL 3.3.27

## References

- [https://access.redhat.com/security/cve/CVE-2025-23366](https://access.redhat.com/security/cve/CVE-2025-23366)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2337619](https://bugzilla.redhat.com/show_bug.cgi?id=2337619)
- [https://access.redhat.com/errata/RHSA-2025:10924](https://access.redhat.com/errata/RHSA-2025:10924)
- [https://access.redhat.com/errata/RHSA-2025:10926](https://access.redhat.com/errata/RHSA-2025:10926)
- [https://access.redhat.com/errata/RHSA-2025:10925](https://access.redhat.com/errata/RHSA-2025:10925)

## Related threats

- [Wildfly IIOP listener pre-authentication deserialization](https://junglewise.ai/threats/cve-2026-15564-wildfly-s-iiop-listener-may-permit-deserialization-of-input)
- [WildFly authentication bypass in IIOP EJB CSIv2](https://junglewise.ai/threats/cve-2026-114488-a-flaw-was-found-in-wildfly-a-remote-attacker-can-bypass)
- [WildFly path traversal in take-snapshot operation](https://junglewise.ai/threats/cve-2026-84823-a-flaw-was-found-in-wildfly-a-user-with-the-monitor-role-which-is)
- [WildFly and JBoss EAP path traversal in ContentRepositoryImpl](https://junglewise.ai/threats/cve-2026-85634-a-flaw-was-found-in-the-contentrepositoryimpl-copyexplodedcontent)
- [Undertow WebSocket resource exhaustion via unbounded buffers](https://junglewise.ai/threats/cve-2026-81624-undertow-websocket-resource-exhaustion-via-unbounded-buffers)