# CVE-2025-23366

## Summary

- **CVE ID:** CVE-2025-23366
- **Severity:** MEDIUM
- **CVSS Score:** 6.5 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N)
- **CWE:** CWE-79
- **Published:** Jan 14, 2025
- **Last Modified:** Aug 19, 2026

## Description

A flaw was found in the HAL Console in the Wildfly component, which does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output used as a web page that is served to other users. The attacker must be authenticated as a user that belongs to management groups “SuperUser”, “Admin”, or “Maintainer”.

## Affected Products

- Unknown product (0)
- Red Hat — Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 (0:2.16.0-21.redhat_00055.1.el8eap)
- Red Hat — Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 (0:3.5.10-1.redhat_00001.1.el8eap)
- Red Hat — Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 (1:1.0.2-5.redhat_00004.1.el8eap)
- Red Hat — Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 (0:1.9.6-1.Final_redhat_00001.1.el8eap)
- Red Hat — Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 (0:2.3.14-9.SP10_redhat_00001.1.el8eap)
- Red Hat — Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 (0:3.3.27-1.Final_redhat_00001.1.el8eap)
- Red Hat — Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 (0:6.0.23-3.SP2_redhat_00001.1.el8eap)
- Red Hat — Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 (0:1.5.21-1.Final_redhat_00001.1.el8eap)
- Red Hat — Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 (0:1.10.0-42.Final_redhat_00042.1.el8eap)
- Red Hat — Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 (0:5.4.15-1.Final_redhat_00001.1.el8eap)
- Red Hat — Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 (0:7.4.23-3.GA_redhat_00002.1.el8eap)
- Red Hat — Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 (0:1.15.26-1.Final_redhat_00001.1.el8eap)
- Red Hat — Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 (0:2.16.0-21.redhat_00055.1.el9eap)
- Red Hat — Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 (0:3.5.10-1.redhat_00001.1.el9eap)
- Red Hat — Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 (1:1.0.2-5.redhat_00004.1.el9eap)
- Red Hat — Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 (0:1.9.6-1.Final_redhat_00001.1.el9eap)
- Red Hat — Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 (0:2.3.14-9.SP10_redhat_00001.1.el9eap)
- Red Hat — Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 (0:3.3.27-1.Final_redhat_00001.1.el9eap)
- Red Hat — Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 (0:6.0.23-3.SP2_redhat_00001.1.el9eap)
- Red Hat — Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 (0:1.5.21-1.Final_redhat_00001.1.el9eap)
- Red Hat — Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 (0:1.10.0-42.Final_redhat_00042.1.el9eap)
- Red Hat — Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 (0:5.4.15-1.Final_redhat_00001.1.el9eap)
- Red Hat — Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 (0:7.4.23-3.GA_redhat_00002.1.el9eap)
- Red Hat — Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 (0:1.15.26-1.Final_redhat_00001.1.el9eap)
- Red Hat — Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 (0:2.16.0-21.redhat_00055.1.el7eap)
- Red Hat — Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 (0:3.5.10-1.redhat_00001.1.el7eap)
- Red Hat — Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 (1:1.0.2-5.redhat_00004.1.el7eap)
- Red Hat — Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 (0:1.9.6-1.Final_redhat_00001.1.el7eap)
- Red Hat — Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 (0:2.3.14-9.SP10_redhat_00001.1.el7eap)
- Red Hat — Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 (0:3.3.27-1.Final_redhat_00001.1.el7eap)
- Red Hat — Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 (0:6.0.23-3.SP2_redhat_00001.1.el7eap)
- Red Hat — Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 (0:1.5.21-1.Final_redhat_00001.1.el7eap)
- Red Hat — Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 (0:1.10.0-42.Final_redhat_00042.1.el7eap)
- Red Hat — Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 (0:5.4.15-1.Final_redhat_00001.1.el7eap)
- Red Hat — Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 (0:7.4.23-3.GA_redhat_00002.1.el7eap)
- Red Hat — Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 (0:1.15.26-1.Final_redhat_00001.1.el7eap)

## References

- [CNA](https://access.redhat.com/errata/RHSA-2025:10924)
- [CNA](https://access.redhat.com/errata/RHSA-2025:10925)
- [CNA](https://access.redhat.com/errata/RHSA-2025:10926)
- [CNA](https://access.redhat.com/security/cve/CVE-2025-23366)
- [CNA](https://bugzilla.redhat.com/show_bug.cgi?id=2337619)
- [CNA](https://access.redhat.com/errata/RHSA-2025:10931)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.45%
- **EPSS Percentile:** 38.4

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-18._