Cross Site Scripting (XSS) vulnerability while uploading content to a new deployment

published 2024-12-23 last yr. modified 2026-09-10 2mo ago

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

A vulnerability was found in the WildFly management console. A user may perform cross-site scripting in the deployment system. An attacker (or insider) may execute a malicious payload which could trigger an undesired behavior against the server.

### Impact Cross-site scripting (XSS) vulnerability in the management console.

### Patches Fixed in [HAL 3.7.7.Final](https://github.com/hal/console/releases/tag/v3.7.7)

### Workarounds No workaround available

### References See also: https://issues.redhat.com/browse/WFLY-19969

Patch / fix

fixed in 1 links 1

maven org.jboss.hal:hal-console 3.7.7.Final

github.com/hal/console/releases/tag/v3.7.7 release

Is GHSA-64gp-r758-8pfm in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
maven	org.jboss.hal:hal-console	<3.7.7.Final	3.7.7.Final

Classification

Weakness

CWE-1395 Dependency on Vulnerable Third-Party Component
CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

GitHub Advisory GHSA-64gp-r758-8pfm

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.