CVE-2025-23366

What it is

A flaw was found in the HAL Console in the Wildfly component, which does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output used as a web page that is served to other users. The attacker must be authenticated as a user that belongs to management groups “SuperUser”, “Admin”, or “Maintainer”.

At a glance

Exploitability

Can be exploited over the network with an admin-level account. High risk of data exposure, data tampering.

Exploit odds

0.5% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2025-01-14 18:16 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-08-19 01:16 UTC Last updatedMost recent change to the record

Details

Published

2025-01-14 18:16 UTC

Last modified

2026-08-19 01:16 UTC

Exploit probability

0.5% · EPSS, next 30 days

Weakness

CWE-79 · Cross-site scripting

Record status

Modified

Affected

• Redhat Hal Management Console < 3.7.7

Attack profile CVSS 3.1 · 6.5

Attack vector

Network

Complexity

Low

Privileges needed

High

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None