Cross-Site Scripting Vulnerability in Wildfly by Red Hat
CVE-2025-23366
6.5MEDIUM
Summary
A cross-site scripting vulnerability exists in the HAL Console of Wildfly. This flaw allows an attacker with authenticated access, specifically belonging to management groups such as 'SuperUser', 'Admin', or 'Maintainer', to execute arbitrary scripts in the context of other users' browsers. The issue arises due to inadequate neutralization of user-controllable input before it is rendered on web pages served to other users, posing significant security risks.
References
CVSS V3.1
Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Credit
Red Hat would like to thank Claudia Bartolini (TIM S.p.A), Marco Ventura (TIM S.p.A), and Massimiliano Brolli (TIM S.p.A) for reporting this issue.