GitHub Advisoryadvisory · Maven

GHSA-64gp-r758-8pfm Cross Site Scripting (XSS) vulnerability while uploading content to a new deployment

MEDIUM Published 2024-12-23 Modified 2024-12-23 Official page ↗
Ecosystem
Maven
Packages
org.jboss.hal:hal-console
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Weaknesses
CWE-1395, CWE-79
Reviewed
2024-12-23

Affected packages

• Maven org.jboss.hal:hal-console: < 3.7.7.Final → fixed in 3.7.7.Final

Description

A vulnerability was found in the WildFly management console. A user may perform cross-site scripting in the deployment system. An attacker (or insider) may execute a malicious payload which could trigger an undesired behavior against the server. Impact Cross-site scripting (XSS) vulnerability in the management console. Patches Fixed in HAL 3.7.7.Final Workarounds No workaround available References See also: https://issues.redhat.com/browse/WFLY-19969

Related

Weakness · CWE (2)

  • CWE-1395 Dependency on Vulnerable Third-Party Component weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References