Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A flaw was found in the JBoss EAP Management Console, where a stored Cross-site scripting vulnerability occurs when an application improperly sanitizes user input before storing it in a data store. When this stored data is later included in web pages without adequate sanitization, malicious scripts can execute in the context of users who view these pages, leading to potential data theft, session hijacking, or other malicious activities. Impact Cross-site scripting (XSS) vulnerability in the management console. Patches Fixed in HAL 3.7.11.Final Workarounds No workaround available
Recommended action: Upgrade to 3.7.11.Final or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A flaw was found in the HAL Console in the Wildfly component, which does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output used as a web page that is served to other users. The attacker must be authenticated as a user that belongs to management groups “SuperUser”, “Admin”, or “Maintainer”. Impact Cross-site scripting (XSS) vulnerability in the management console. Patches Fixed in HAL 3.7.7.Final Workarounds No workaround available References - https://access.redhat.com/security/cve/CVE-2025-23366 - https://bugzilla.redhat.com/showbug.cgi?id=2337619
Recommended action: Upgrade to 3.7.7.Final or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A vulnerability was found in the WildFly management console. A user may perform cross-site scripting in the deployment system. An attacker (or insider) may execute a malicious payload which could trigger an undesired behavior against the server. Impact Cross-site scripting (XSS) vulnerability in the management console. Patches Fixed in HAL 3.7.7.Final Workarounds No workaround available References See also: https://issues.redhat.com/browse/WFLY-19969
Recommended action: Upgrade to 3.7.7.Final or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.