CVE-2025-23366
Org.jboss.hal:hal-console: wildfly hal console cross-site scripting
6.5 MediumFix available
A flaw was found in the HAL Console in the Wildfly component, which does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output used as a web page that is served to other users. The attacker must be authenticated as a user that belongs to management groups “SuperUser”, “Admin”, or “Maintainer”.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
0.46%Up 0.4 points since Jan 15, 2025
What each source reports
CVE List Score used
Org.jboss.hal:hal-console: wildfly hal console cross-site scripting
A flaw was found in the HAL Console in the Wildfly component, which does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output used as a web page that is served to other users. The attacker must be authenticated as a user that belongs to management groups “SuperUser”, “Admin”, or “Maintainer”.
- Record
CVE-2025-23366- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2025-0099
A flaw was found in the HAL Console in the Wildfly component, which does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output used as a web page that is served to other users. The attacker must be authenticated as a user that belongs to management groups “SuperUser”, “Admin”, or “Maintainer”.
- Record
EUVD-2025-0099- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-jhvj-f397-8w6q
HAL Console has a Cross Site Scripting (XSS) vulnerability of user input
A flaw was found in the HAL Console in the Wildfly component, which does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output used as a web page that is served to other users. The attacker must be authenticated as a user that belongs to management groups “SuperUser”, “Admin”, or “Maintainer”.
Impact
Cross-site scripting (XSS) vulnerability in the management console.
Patches
Fixed in HAL 3.7.7.Final
Workarounds
No workaround available
References
- Record
GHSA-jhvj-f397-8w6q- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
A flaw was found in the HAL Console in the Wildfly component, which does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output used as a web page that is served to other users. The attacker must be authenticated as a user that belongs to management groups “SuperUser”, “Admin”, or “Maintainer”.
- Record
CVE-2025-23366- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N - CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Org.jboss.hal:hal-console: wildfly hal console cross-site scripting
A flaw was found in the HAL Console in the Wildfly component, which does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output used as a web page that is served to other users. The attacker must be authenticated as a user that belongs to management groups “SuperUser”, “Admin”, or “Maintainer”.
- Record
CVE-2025-23366- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-jhvj-f397-8w6q
HAL Console has a Cross Site Scripting (XSS) vulnerability of user input
A flaw was found in the HAL Console in the Wildfly component, which does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output used as a web page that is served to other users. The attacker must be authenticated as a user that belongs to management groups “SuperUser”, “Admin”, or “Maintainer”.
Impact
Cross-site scripting (XSS) vulnerability in the management console.
Patches
Fixed in HAL 3.7.7.Final
Workarounds
No workaround available
References
- Record
GHSA-jhvj-f397-8w6q- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVRHSA-2025:10924
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.23 Security update
- Record
RHSA-2025:10924- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2025:10925
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.23 Security update
- Record
RHSA-2025:10925- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2025:10926
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.23 Security update
- Record
RHSA-2025:10926- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jboss.hal:hal-consoleMaven |
before 3.7.7.Final | 3.7.7.Final |
org.jboss.hal:hal-consoleMaven |
before 3.7.7.Final, plus listed versions 3.5.0.Final3.5.1.Final3.5.10.Final3.5.11.Final3.5.12.Final Show 38 moreShow less3.5.2.Final3.5.3.Final3.5.4.Final3.5.5.Final3.5.6.Final3.5.7.Final3.5.8.Final3.5.9.Final3.6.0.Final3.6.1.Final3.6.10.Final3.6.11.Final3.6.12.Final3.6.13.Final3.6.14.Final3.6.15.Final3.6.16.Final3.6.17.Final3.6.18.Final3.6.19.Final3.6.2.Final3.6.20.Final3.6.21.Final3.6.22.Final3.6.23.Final3.6.24.Final3.6.27.Final3.6.3.Final3.6.4.Final3.6.5.Final3.6.6.Final3.6.7.Final3.6.8.Final3.6.9.Final3.7.0.Final3.7.4.Final3.7.5.Final3.7.6.Final |
3.7.7.Final |
eap7-activemq-artemisRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el7eap | 0:2.16.0-21.redhat_00055.1.el7eap |
eap7-activemq-artemis-cliRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el7eap | 0:2.16.0-21.redhat_00055.1.el7eap |
eap7-activemq-artemis-commonsRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el7eap | 0:2.16.0-21.redhat_00055.1.el7eap |
eap7-activemq-artemis-core-clientRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el7eap | 0:2.16.0-21.redhat_00055.1.el7eap |
eap7-activemq-artemis-dtoRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el7eap | 0:2.16.0-21.redhat_00055.1.el7eap |
eap7-activemq-artemis-hornetq-protocolRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el7eap | 0:2.16.0-21.redhat_00055.1.el7eap |
eap7-activemq-artemis-hqclient-protocolRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el7eap | 0:2.16.0-21.redhat_00055.1.el7eap |
eap7-activemq-artemis-jdbc-storeRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el7eap | 0:2.16.0-21.redhat_00055.1.el7eap |
Show 139 moreShow less
| Package | Affected | Fixed |
|---|---|---|
eap7-activemq-artemis-jms-clientRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el7eap | 0:2.16.0-21.redhat_00055.1.el7eap |
eap7-activemq-artemis-jms-serverRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el7eap | 0:2.16.0-21.redhat_00055.1.el7eap |
eap7-activemq-artemis-journalRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el7eap | 0:2.16.0-21.redhat_00055.1.el7eap |
eap7-activemq-artemis-raRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el7eap | 0:2.16.0-21.redhat_00055.1.el7eap |
eap7-activemq-artemis-selectorRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el7eap | 0:2.16.0-21.redhat_00055.1.el7eap |
eap7-activemq-artemis-serverRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el7eap | 0:2.16.0-21.redhat_00055.1.el7eap |
eap7-activemq-artemis-service-extensionsRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el7eap | 0:2.16.0-21.redhat_00055.1.el7eap |
eap7-activemq-artemis-toolsRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el7eap | 0:2.16.0-21.redhat_00055.1.el7eap |
eap7-apache-cxfRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:3.5.10-1.redhat_00001.1.el7eap | 0:3.5.10-1.redhat_00001.1.el7eap |
eap7-apache-cxf-rtRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:3.5.10-1.redhat_00001.1.el7eap | 0:3.5.10-1.redhat_00001.1.el7eap |
eap7-apache-cxf-servicesRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:3.5.10-1.redhat_00001.1.el7eap | 0:3.5.10-1.redhat_00001.1.el7eap |
eap7-apache-cxf-toolsRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:3.5.10-1.redhat_00001.1.el7eap | 0:3.5.10-1.redhat_00001.1.el7eap |
eap7-artemis-nativeRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 1:1.0.2-5.redhat_00004.1.el7eap | 1:1.0.2-5.redhat_00004.1.el7eap |
eap7-artemis-native-debuginfoRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 1:1.0.2-5.redhat_00004.1.el7eap | 1:1.0.2-5.redhat_00004.1.el7eap |
eap7-artemis-native-wildflyRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 1:1.0.2-5.redhat_00004.1.el7eap | 1:1.0.2-5.redhat_00004.1.el7eap |
eap7-elytron-webRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:1.9.6-1.Final_redhat_00001.1.el7eap | 0:1.9.6-1.Final_redhat_00001.1.el7eap |
eap7-glassfish-jsfRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:2.3.14-9.SP10_redhat_00001.1.el7eap | 0:2.3.14-9.SP10_redhat_00001.1.el7eap |
eap7-hal-consoleRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:3.3.27-1.Final_redhat_00001.1.el7eap | 0:3.3.27-1.Final_redhat_00001.1.el7eap |
eap7-hibernate-validatorRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:6.0.23-3.SP2_redhat_00001.1.el7eap | 0:6.0.23-3.SP2_redhat_00001.1.el7eap |
eap7-hibernate-validator-cdiRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:6.0.23-3.SP2_redhat_00001.1.el7eap | 0:6.0.23-3.SP2_redhat_00001.1.el7eap |
eap7-ironjacamarRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:1.5.21-1.Final_redhat_00001.1.el7eap | 0:1.5.21-1.Final_redhat_00001.1.el7eap |
eap7-ironjacamar-common-apiRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:1.5.21-1.Final_redhat_00001.1.el7eap | 0:1.5.21-1.Final_redhat_00001.1.el7eap |
eap7-ironjacamar-common-implRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:1.5.21-1.Final_redhat_00001.1.el7eap | 0:1.5.21-1.Final_redhat_00001.1.el7eap |
eap7-ironjacamar-common-spiRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:1.5.21-1.Final_redhat_00001.1.el7eap | 0:1.5.21-1.Final_redhat_00001.1.el7eap |
eap7-ironjacamar-core-apiRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:1.5.21-1.Final_redhat_00001.1.el7eap | 0:1.5.21-1.Final_redhat_00001.1.el7eap |
eap7-ironjacamar-core-implRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:1.5.21-1.Final_redhat_00001.1.el7eap | 0:1.5.21-1.Final_redhat_00001.1.el7eap |
eap7-ironjacamar-deployers-commonRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:1.5.21-1.Final_redhat_00001.1.el7eap | 0:1.5.21-1.Final_redhat_00001.1.el7eap |
eap7-ironjacamar-jdbcRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:1.5.21-1.Final_redhat_00001.1.el7eap | 0:1.5.21-1.Final_redhat_00001.1.el7eap |
eap7-ironjacamar-validatorRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:1.5.21-1.Final_redhat_00001.1.el7eap | 0:1.5.21-1.Final_redhat_00001.1.el7eap |
eap7-jboss-server-migrationRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:1.10.0-42.Final_redhat_00042.1.el7eap | 0:1.10.0-42.Final_redhat_00042.1.el7eap |
eap7-jboss-server-migration-cliRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:1.10.0-42.Final_redhat_00042.1.el7eap | 0:1.10.0-42.Final_redhat_00042.1.el7eap |
eap7-jboss-server-migration-coreRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:1.10.0-42.Final_redhat_00042.1.el7eap | 0:1.10.0-42.Final_redhat_00042.1.el7eap |
eap7-jbossws-cxfRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:5.4.15-1.Final_redhat_00001.1.el7eap | 0:5.4.15-1.Final_redhat_00001.1.el7eap |
eap7-undertow-serverRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:1.9.6-1.Final_redhat_00001.1.el7eap | 0:1.9.6-1.Final_redhat_00001.1.el7eap |
eap7-wildflyRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:7.4.23-3.GA_redhat_00002.1.el7eap | 0:7.4.23-3.GA_redhat_00002.1.el7eap |
eap7-wildfly-elytronRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:1.15.26-1.Final_redhat_00001.1.el7eap | 0:1.15.26-1.Final_redhat_00001.1.el7eap |
eap7-wildfly-elytron-toolRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:1.15.26-1.Final_redhat_00001.1.el7eap | 0:1.15.26-1.Final_redhat_00001.1.el7eap |
eap7-wildfly-java-jdk11Red Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:7.4.23-3.GA_redhat_00002.1.el7eap | 0:7.4.23-3.GA_redhat_00002.1.el7eap |
eap7-wildfly-java-jdk8Red Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:7.4.23-3.GA_redhat_00002.1.el7eap | 0:7.4.23-3.GA_redhat_00002.1.el7eap |
eap7-wildfly-javadocsRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:7.4.23-3.GA_redhat_00002.1.el7eap | 0:7.4.23-3.GA_redhat_00002.1.el7eap |
eap7-wildfly-modulesRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 7 CVEs |
before 0:7.4.23-3.GA_redhat_00002.1.el7eap | 0:7.4.23-3.GA_redhat_00002.1.el7eap |
eap7-activemq-artemisRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el8eap | 0:2.16.0-21.redhat_00055.1.el8eap |
eap7-activemq-artemis-cliRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el8eap | 0:2.16.0-21.redhat_00055.1.el8eap |
eap7-activemq-artemis-commonsRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el8eap | 0:2.16.0-21.redhat_00055.1.el8eap |
eap7-activemq-artemis-core-clientRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el8eap | 0:2.16.0-21.redhat_00055.1.el8eap |
eap7-activemq-artemis-dtoRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el8eap | 0:2.16.0-21.redhat_00055.1.el8eap |
eap7-activemq-artemis-hornetq-protocolRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el8eap | 0:2.16.0-21.redhat_00055.1.el8eap |
eap7-activemq-artemis-hqclient-protocolRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el8eap | 0:2.16.0-21.redhat_00055.1.el8eap |
eap7-activemq-artemis-jdbc-storeRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el8eap | 0:2.16.0-21.redhat_00055.1.el8eap |
eap7-activemq-artemis-jms-clientRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el8eap | 0:2.16.0-21.redhat_00055.1.el8eap |
eap7-activemq-artemis-jms-serverRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el8eap | 0:2.16.0-21.redhat_00055.1.el8eap |
eap7-activemq-artemis-journalRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el8eap | 0:2.16.0-21.redhat_00055.1.el8eap |
eap7-activemq-artemis-raRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el8eap | 0:2.16.0-21.redhat_00055.1.el8eap |
eap7-activemq-artemis-selectorRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el8eap | 0:2.16.0-21.redhat_00055.1.el8eap |
eap7-activemq-artemis-serverRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el8eap | 0:2.16.0-21.redhat_00055.1.el8eap |
eap7-activemq-artemis-service-extensionsRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el8eap | 0:2.16.0-21.redhat_00055.1.el8eap |
eap7-activemq-artemis-toolsRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el8eap | 0:2.16.0-21.redhat_00055.1.el8eap |
eap7-apache-cxfRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:3.5.10-1.redhat_00001.1.el8eap | 0:3.5.10-1.redhat_00001.1.el8eap |
eap7-apache-cxf-rtRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:3.5.10-1.redhat_00001.1.el8eap | 0:3.5.10-1.redhat_00001.1.el8eap |
eap7-apache-cxf-servicesRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:3.5.10-1.redhat_00001.1.el8eap | 0:3.5.10-1.redhat_00001.1.el8eap |
eap7-apache-cxf-toolsRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:3.5.10-1.redhat_00001.1.el8eap | 0:3.5.10-1.redhat_00001.1.el8eap |
eap7-artemis-nativeRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 1:1.0.2-5.redhat_00004.1.el8eap | 1:1.0.2-5.redhat_00004.1.el8eap |
eap7-artemis-native-wildflyRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 1:1.0.2-5.redhat_00004.1.el8eap | 1:1.0.2-5.redhat_00004.1.el8eap |
eap7-elytron-webRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:1.9.6-1.Final_redhat_00001.1.el8eap | 0:1.9.6-1.Final_redhat_00001.1.el8eap |
eap7-glassfish-jsfRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:2.3.14-9.SP10_redhat_00001.1.el8eap | 0:2.3.14-9.SP10_redhat_00001.1.el8eap |
eap7-hal-consoleRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:3.3.27-1.Final_redhat_00001.1.el8eap | 0:3.3.27-1.Final_redhat_00001.1.el8eap |
eap7-hibernate-validatorRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:6.0.23-3.SP2_redhat_00001.1.el8eap | 0:6.0.23-3.SP2_redhat_00001.1.el8eap |
eap7-hibernate-validator-cdiRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:6.0.23-3.SP2_redhat_00001.1.el8eap | 0:6.0.23-3.SP2_redhat_00001.1.el8eap |
eap7-ironjacamarRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:1.5.21-1.Final_redhat_00001.1.el8eap | 0:1.5.21-1.Final_redhat_00001.1.el8eap |
eap7-ironjacamar-common-apiRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:1.5.21-1.Final_redhat_00001.1.el8eap | 0:1.5.21-1.Final_redhat_00001.1.el8eap |
eap7-ironjacamar-common-implRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:1.5.21-1.Final_redhat_00001.1.el8eap | 0:1.5.21-1.Final_redhat_00001.1.el8eap |
eap7-ironjacamar-common-spiRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:1.5.21-1.Final_redhat_00001.1.el8eap | 0:1.5.21-1.Final_redhat_00001.1.el8eap |
eap7-ironjacamar-core-apiRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:1.5.21-1.Final_redhat_00001.1.el8eap | 0:1.5.21-1.Final_redhat_00001.1.el8eap |
eap7-ironjacamar-core-implRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:1.5.21-1.Final_redhat_00001.1.el8eap | 0:1.5.21-1.Final_redhat_00001.1.el8eap |
eap7-ironjacamar-deployers-commonRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:1.5.21-1.Final_redhat_00001.1.el8eap | 0:1.5.21-1.Final_redhat_00001.1.el8eap |
eap7-ironjacamar-jdbcRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:1.5.21-1.Final_redhat_00001.1.el8eap | 0:1.5.21-1.Final_redhat_00001.1.el8eap |
eap7-ironjacamar-validatorRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:1.5.21-1.Final_redhat_00001.1.el8eap | 0:1.5.21-1.Final_redhat_00001.1.el8eap |
eap7-jboss-server-migrationRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:1.10.0-42.Final_redhat_00042.1.el8eap | 0:1.10.0-42.Final_redhat_00042.1.el8eap |
eap7-jboss-server-migration-cliRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:1.10.0-42.Final_redhat_00042.1.el8eap | 0:1.10.0-42.Final_redhat_00042.1.el8eap |
eap7-jboss-server-migration-coreRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:1.10.0-42.Final_redhat_00042.1.el8eap | 0:1.10.0-42.Final_redhat_00042.1.el8eap |
eap7-jbossws-cxfRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:5.4.15-1.Final_redhat_00001.1.el8eap | 0:5.4.15-1.Final_redhat_00001.1.el8eap |
eap7-undertow-serverRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:1.9.6-1.Final_redhat_00001.1.el8eap | 0:1.9.6-1.Final_redhat_00001.1.el8eap |
eap7-wildflyRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:7.4.23-3.GA_redhat_00002.1.el8eap | 0:7.4.23-3.GA_redhat_00002.1.el8eap |
eap7-wildfly-elytronRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:1.15.26-1.Final_redhat_00001.1.el8eap | 0:1.15.26-1.Final_redhat_00001.1.el8eap |
eap7-wildfly-elytron-toolRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:1.15.26-1.Final_redhat_00001.1.el8eap | 0:1.15.26-1.Final_redhat_00001.1.el8eap |
eap7-wildfly-java-jdk11Red Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:7.4.23-3.GA_redhat_00002.1.el8eap | 0:7.4.23-3.GA_redhat_00002.1.el8eap |
eap7-wildfly-java-jdk17Red Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:7.4.23-3.GA_redhat_00002.1.el8eap | 0:7.4.23-3.GA_redhat_00002.1.el8eap |
eap7-wildfly-java-jdk8Red Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:7.4.23-3.GA_redhat_00002.1.el8eap | 0:7.4.23-3.GA_redhat_00002.1.el8eap |
eap7-wildfly-javadocsRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:7.4.23-3.GA_redhat_00002.1.el8eap | 0:7.4.23-3.GA_redhat_00002.1.el8eap |
eap7-wildfly-modulesRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 7 CVEs |
before 0:7.4.23-3.GA_redhat_00002.1.el8eap | 0:7.4.23-3.GA_redhat_00002.1.el8eap |
eap7-activemq-artemisRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el9eap | 0:2.16.0-21.redhat_00055.1.el9eap |
eap7-activemq-artemis-cliRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el9eap | 0:2.16.0-21.redhat_00055.1.el9eap |
eap7-activemq-artemis-commonsRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el9eap | 0:2.16.0-21.redhat_00055.1.el9eap |
eap7-activemq-artemis-core-clientRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el9eap | 0:2.16.0-21.redhat_00055.1.el9eap |
eap7-activemq-artemis-dtoRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el9eap | 0:2.16.0-21.redhat_00055.1.el9eap |
eap7-activemq-artemis-hornetq-protocolRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el9eap | 0:2.16.0-21.redhat_00055.1.el9eap |
eap7-activemq-artemis-hqclient-protocolRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el9eap | 0:2.16.0-21.redhat_00055.1.el9eap |
eap7-activemq-artemis-jdbc-storeRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el9eap | 0:2.16.0-21.redhat_00055.1.el9eap |
eap7-activemq-artemis-jms-clientRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el9eap | 0:2.16.0-21.redhat_00055.1.el9eap |
eap7-activemq-artemis-jms-serverRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el9eap | 0:2.16.0-21.redhat_00055.1.el9eap |
eap7-activemq-artemis-journalRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el9eap | 0:2.16.0-21.redhat_00055.1.el9eap |
eap7-activemq-artemis-raRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el9eap | 0:2.16.0-21.redhat_00055.1.el9eap |
eap7-activemq-artemis-selectorRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el9eap | 0:2.16.0-21.redhat_00055.1.el9eap |
eap7-activemq-artemis-serverRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el9eap | 0:2.16.0-21.redhat_00055.1.el9eap |
eap7-activemq-artemis-service-extensionsRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el9eap | 0:2.16.0-21.redhat_00055.1.el9eap |
eap7-activemq-artemis-toolsRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:2.16.0-21.redhat_00055.1.el9eap | 0:2.16.0-21.redhat_00055.1.el9eap |
eap7-apache-cxfRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:3.5.10-1.redhat_00001.1.el9eap | 0:3.5.10-1.redhat_00001.1.el9eap |
eap7-apache-cxf-rtRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:3.5.10-1.redhat_00001.1.el9eap | 0:3.5.10-1.redhat_00001.1.el9eap |
eap7-apache-cxf-servicesRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:3.5.10-1.redhat_00001.1.el9eap | 0:3.5.10-1.redhat_00001.1.el9eap |
eap7-apache-cxf-toolsRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:3.5.10-1.redhat_00001.1.el9eap | 0:3.5.10-1.redhat_00001.1.el9eap |
eap7-artemis-nativeRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 1:1.0.2-5.redhat_00004.1.el9eap | 1:1.0.2-5.redhat_00004.1.el9eap |
eap7-artemis-native-wildflyRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 1:1.0.2-5.redhat_00004.1.el9eap | 1:1.0.2-5.redhat_00004.1.el9eap |
eap7-elytron-webRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:1.9.6-1.Final_redhat_00001.1.el9eap | 0:1.9.6-1.Final_redhat_00001.1.el9eap |
eap7-glassfish-jsfRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:2.3.14-9.SP10_redhat_00001.1.el9eap | 0:2.3.14-9.SP10_redhat_00001.1.el9eap |
eap7-hal-consoleRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:3.3.27-1.Final_redhat_00001.1.el9eap | 0:3.3.27-1.Final_redhat_00001.1.el9eap |
eap7-hibernate-validatorRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:6.0.23-3.SP2_redhat_00001.1.el9eap | 0:6.0.23-3.SP2_redhat_00001.1.el9eap |
eap7-hibernate-validator-cdiRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:6.0.23-3.SP2_redhat_00001.1.el9eap | 0:6.0.23-3.SP2_redhat_00001.1.el9eap |
eap7-ironjacamarRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:1.5.21-1.Final_redhat_00001.1.el9eap | 0:1.5.21-1.Final_redhat_00001.1.el9eap |
eap7-ironjacamar-common-apiRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:1.5.21-1.Final_redhat_00001.1.el9eap | 0:1.5.21-1.Final_redhat_00001.1.el9eap |
eap7-ironjacamar-common-implRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:1.5.21-1.Final_redhat_00001.1.el9eap | 0:1.5.21-1.Final_redhat_00001.1.el9eap |
eap7-ironjacamar-common-spiRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:1.5.21-1.Final_redhat_00001.1.el9eap | 0:1.5.21-1.Final_redhat_00001.1.el9eap |
eap7-ironjacamar-core-apiRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:1.5.21-1.Final_redhat_00001.1.el9eap | 0:1.5.21-1.Final_redhat_00001.1.el9eap |
eap7-ironjacamar-core-implRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:1.5.21-1.Final_redhat_00001.1.el9eap | 0:1.5.21-1.Final_redhat_00001.1.el9eap |
eap7-ironjacamar-deployers-commonRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:1.5.21-1.Final_redhat_00001.1.el9eap | 0:1.5.21-1.Final_redhat_00001.1.el9eap |
eap7-ironjacamar-jdbcRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:1.5.21-1.Final_redhat_00001.1.el9eap | 0:1.5.21-1.Final_redhat_00001.1.el9eap |
eap7-ironjacamar-validatorRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:1.5.21-1.Final_redhat_00001.1.el9eap | 0:1.5.21-1.Final_redhat_00001.1.el9eap |
eap7-jboss-server-migrationRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:1.10.0-42.Final_redhat_00042.1.el9eap | 0:1.10.0-42.Final_redhat_00042.1.el9eap |
eap7-jboss-server-migration-cliRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:1.10.0-42.Final_redhat_00042.1.el9eap | 0:1.10.0-42.Final_redhat_00042.1.el9eap |
eap7-jboss-server-migration-coreRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:1.10.0-42.Final_redhat_00042.1.el9eap | 0:1.10.0-42.Final_redhat_00042.1.el9eap |
eap7-jbossws-cxfRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:5.4.15-1.Final_redhat_00001.1.el9eap | 0:5.4.15-1.Final_redhat_00001.1.el9eap |
eap7-undertow-serverRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:1.9.6-1.Final_redhat_00001.1.el9eap | 0:1.9.6-1.Final_redhat_00001.1.el9eap |
eap7-wildflyRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:7.4.23-3.GA_redhat_00002.1.el9eap | 0:7.4.23-3.GA_redhat_00002.1.el9eap |
eap7-wildfly-elytronRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:1.15.26-1.Final_redhat_00001.1.el9eap | 0:1.15.26-1.Final_redhat_00001.1.el9eap |
eap7-wildfly-elytron-toolRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:1.15.26-1.Final_redhat_00001.1.el9eap | 0:1.15.26-1.Final_redhat_00001.1.el9eap |
eap7-wildfly-java-jdk11Red Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:7.4.23-3.GA_redhat_00002.1.el9eap | 0:7.4.23-3.GA_redhat_00002.1.el9eap |
eap7-wildfly-java-jdk17Red Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:7.4.23-3.GA_redhat_00002.1.el9eap | 0:7.4.23-3.GA_redhat_00002.1.el9eap |
eap7-wildfly-java-jdk8Red Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:7.4.23-3.GA_redhat_00002.1.el9eap | 0:7.4.23-3.GA_redhat_00002.1.el9eap |
eap7-wildfly-javadocsRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:7.4.23-3.GA_redhat_00002.1.el9eap | 0:7.4.23-3.GA_redhat_00002.1.el9eap |
eap7-wildfly-modulesRed Hat:jboss_enterprise_application_platform:7.4::el9 From an advisory covering 7 CVEs |
before 0:7.4.23-3.GA_redhat_00002.1.el9eap | 0:7.4.23-3.GA_redhat_00002.1.el9eap |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-23366 is a medium vulnerability (CVSS 6.5) in Red Hat Jboss Data Grid 7, published January 14, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 40th percentile. Fixed in org.jboss.hal:hal-console 3.7.7.Final.
References
access.redhat.com/errata/RHSA-2025:10924
bugzilla.redhat.com/show_bug.cgi?id=2337619
Show 75 moreShow less
github.com/hal/console/security/advisories/GHSA-jhvj-f397-8w6q
nvd.nist.gov/vuln/detail/CVE-2025-23366
docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4
issues.redhat.com/browse/JBEAP-28676
security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10924.json
cve.org/CVERecord?id=CVE-2024-10234
lists.apache.org/thread/lfs8l63rnctnj2skfrxyys7v8fgnt122
docs.jboss.org/hibernate/stable/validator/reference/en-US/html_single
hibernate.atlassian.net/browse/HV-1816
hibernate.org/validator/documentation/migration-guide
in.relation.to/2021/01/06/hibernate-validator-700-62-final-released
labs.watchtowr.com/expression-payloads-meet-mayhem-cve-2025-4427-and-cve-2025-4428
openwall.com/lists/oss-security/2025/05/28/6