CVE-2025-2901

org.jboss.hal-hal-parent: Stored Cross-Site Scripting (XSS) in JBoss EAP Management Console

View on CVE.org
Published Mar 28, 2025 CVSS 3.1 · 4.6 Medium EPSS n/a KEV · Not listed
Description
This vulnerability is redundant to CVE-2025-23366 and CVE-2024-10234.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-8614 This vulnerability is redundant to CVE-2025-23366 and CVE-2024-10234.
Github GHSA Github GHSA GHSA-f7jh-m6wp-jm7f HAL Cross Site Scripting (XSS) vulnerability of user input when storing it in a data store
History
Type Values Removed Values Added
First Time appeared Redhat
Redhat jboss Enterprise Application Platform
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
Vendors & Products Redhat
Redhat jboss Enterprise Application Platform
Type Values Removed Values Added
Title Org.jboss.hal-hal-parent: stored cross-site scripting (xss) in jboss eap management console org.jboss.hal-hal-parent: Stored Cross-Site Scripting (XSS) in JBoss EAP Management Console
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A flaw was found in the JBoss EAP Management Console, where a stored Cross-site scripting vulnerability occurs when an application improperly sanitizes user input before storing it in a data store. When this stored data is later included in web pages without adequate sanitization, malicious scripts can execute in the context of users who view these pages, leading to potential data theft, session hijacking, or other malicious activities. This vulnerability is redundant to CVE-2025-23366 and CVE-2024-10234.
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7
cpe:/a:redhat:jboss_enterprise_application_platform:8
cpe:/a:redhat:jbosseapxp
Vendors & Products Redhat
Redhat jboss Enterprise Application Platform
Redhat jbosseapxp
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description No description is available for this CVE. A flaw was found in the JBoss EAP Management Console, where a stored Cross-site scripting vulnerability occurs when an application improperly sanitizes user input before storing it in a data store. When this stored data is later included in web pages without adequate sanitization, malicious scripts can execute in the context of users who view these pages, leading to potential data theft, session hijacking, or other malicious activities.
Title org.jboss.hal-hal-parent: Stored Cross-Site Scripting (XSS) in JBoss EAP Management Console Org.jboss.hal-hal-parent: stored cross-site scripting (xss) in jboss eap management console
First Time appeared Redhat
Redhat jboss Enterprise Application Platform
Redhat jbosseapxp
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7
cpe:/a:redhat:jboss_enterprise_application_platform:8
cpe:/a:redhat:jbosseapxp
Vendors & Products Redhat
Redhat jboss Enterprise Application Platform
Redhat jbosseapxp
References
Type Values Removed Values Added
Description No description is available for this CVE.
Title org.jboss.hal-hal-parent: Stored Cross-Site Scripting (XSS) in JBoss EAP Management Console
Weaknesses CWE-79
References
Metrics threat_severity

None

 cvssV3_1

{'score': 4.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N'}

threat_severity

Moderate
Earlier changes (2)
Weaknesses

Sources

Status
REJECTED
Assigner
redhat
Published
Updated
Jun 20, 2025, 11:50 AM
Reserved
Mar 28, 2025, 6:08 AM

View source JSON

Updated

JSON

Status
Rejected
Published
Mar 28, 2025, 2:15 PM
Modified
Jun 20, 2025, 12:15 PM

View source JSON

Severity
Moderate
Public date
Mar 28, 2025, 12:00 AM

View source Bugzilla JSON

No data.