Description
A flaw was found in the HAL Console in the Wildfly component, which does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output used as a web page that is served to other users. The attacker must be authenticated as a user that belongs to management groups “SuperUser”, “Admin”, or “Maintainer”.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | hal-console | < 3.7.7.Final | 3.7.7.Final |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | — | — |
| Red Hat | Red Hat JBoss Data Grid 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 7 | eap7-activemq-artemis +15 | 2.16.0-21.redhat_00055.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-apache-cxf +3 | 3.5.10-1.redhat_00001.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-artemis-native +1 | 1:1.0.2-5.redhat_00004.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-elytron-web +1 | 1.9.6-1.Final_redhat_00001.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-glassfish-jsf | 2.3.14-9.SP10_redhat_00001.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.3.27-1.Final_redhat_00001.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-hibernate-validator +1 | 6.0.23-3.SP2_redhat_00001.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.5.21-1.Final_redhat_00001.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +2 | 1.10.0-42.Final_redhat_00042.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-jbossws-cxf | 5.4.15-1.Final_redhat_00001.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-wildfly +4 | 7.4.23-3.GA_redhat_00002.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron +1 | 1.15.26-1.Final_redhat_00001.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk17 | 7.4.23-3.GA_redhat_00002.1.el8eap | RHSA-2025:10926, RHSA-2025:10925 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jboss.hal:hal-console | < 3.7.7.Final | 3.7.7.Final | GHSA-jhvj-f397-8w6q |
Advisories 3
- RHSA-2025:10926 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.23 Security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2025:10925 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.23 Security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2025:10924 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.23 Security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
References
- RHSA-2025:10924 vendor-advisory
- RHSA-2025:10925 vendor-advisory
- RHSA-2025:10926 vendor-advisory
- RHSA-2025:10931 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-23366 vdb-entry
- RHBZ#2337619 issue-tracking