GHSA-64gp-r758-8pfm

Source

https://github.com/advisories/GHSA-64gp-r758-8pfm

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/12/GHSA-64gp-r758-8pfm/GHSA-64gp-r758-8pfm.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-64gp-r758-8pfm

Published

2024-12-23T20:15:16Z

Modified

2026-09-10T03:50:21Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

Cross Site Scripting (XSS) vulnerability while uploading content to a new deployment

Details

A vulnerability was found in the WildFly management console. A user may perform cross-site scripting in the deployment system. An attacker (or insider) may execute a malicious payload which could trigger an undesired behavior against the server.

Impact

Cross-site scripting (XSS) vulnerability in the management console.

Patches

Fixed in HAL 3.7.7.Final

Workarounds

No workaround available

References

Database specific

{
    "cwe_ids": [
        "CWE-1395",
        "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-12-23T20:15:16Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
}

References

Affected packages

Maven / org.jboss.hal:hal-console

Package

Name: org.jboss.hal:hal-console; View open source insights on deps.dev
Purl: pkg:maven/org.jboss.hal/hal-console

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.7.7.Final

Affected versions

3.*

3.5.0.Final

3.5.1.Final

3.5.2.Final

3.5.3.Final

3.5.4.Final

3.5.5.Final

3.5.6.Final

3.5.7.Final

3.5.8.Final

3.5.9.Final

3.5.10.Final

3.5.11.Final

3.5.12.Final

3.6.0.Final

3.6.1.Final

3.6.2.Final

3.6.3.Final

3.6.4.Final

3.6.5.Final

3.6.6.Final

3.6.7.Final

3.6.8.Final

3.6.9.Final

3.6.10.Final

3.6.11.Final

3.6.12.Final

3.6.13.Final

3.6.14.Final

3.6.15.Final

3.6.16.Final

3.6.17.Final

3.6.18.Final

3.6.19.Final

3.6.20.Final

3.6.21.Final

3.6.22.Final

3.6.23.Final

3.6.24.Final

3.6.27.Final

3.7.0.Final

3.7.4.Final

3.7.5.Final

3.7.6.Final

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/12/GHSA-64gp-r758-8pfm/GHSA-64gp-r758-8pfm.json"