CVE-2025-23366
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
A flaw was found in the HAL Console in the Wildfly component, which does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output used as a web page that is served to other users. The attacker must be authenticated as a user that belongs to management groups "SuperUser", "Admin", or "Maintainer".
Risk Assessment
The risk is the possibility of executing malicious scripts in other users' browsers, potentially leading to session theft or other attacks.
Recommendation
It is recommended to upgrade Wildfly to a patched version and restrict user privileges to the minimum necessary.
Other vulnerabilities in Wildfly
See all- CVE-2026-15567High
A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size.
- CVE-2026-17614Medium
A path traversal flaw in WildFly's domain mode implementation allows a remote attacker who has obtained the slave host controller secret or compromised a slave host controller to supply a crafted relative path containing directory traversal sequences, causing the Domain Controller to resolve and serve arbitrary files readable by the DC process. This leads to unauthorized disclosure of sensitive information.
- CVE-2025-23367Medium
A flaw in the Wildfly Server Role Based Access Control (RBAC) provider allows a user without the required privileges to suspend or resume the server. A user with a Monitor or Auditor role is supposed to have only read access permissions and should not be able to suspend the server. The vulnerability is caused by the Suspend and Resume handlers not performing authorization checks.
- CVE-2024-10234Medium
A vulnerability was found in Wildfly, where a user may perform Cross-site scripting in the Wildfly deployment system. This flaw allows an attacker or insider to execute a deployment with a malicious payload, which could trigger undesired behavior against the server.
Original NVD description (English source)
A flaw was found in the HAL Console in the Wildfly component, which does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output used as a web page that is served to other users. The attacker must be authenticated as a user that belongs to management groups “SuperUser”, “Admin”, or “Maintainer”.