CVE-2025-23366 is a stored cross-site scripting vulnerability in the HAL Console of Wildfly, which is part of Red Hat JBoss Enterprise Application Platform 7. The vulnerability arises from improper neutralization of user input before it is rendered in web pages served to other users. An attacker must be authenticated with elevated management privileges (SuperUser, Admin, or Maintainer) to exploit this issue. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity with high impact on confidentiality and integrity but no impact on availability. Red Hat has published security advisories (RHSA-2025:10924 and RHSA-2025:10925) that include patches in version 7.4.23 of JBoss EAP for RHEL 7 and RHEL 8, respectively, which fix this vulnerability along with others. The vendor advisory confirms the availability of an official fix and provides detailed upgrade instructions.

Successful exploitation of this vulnerability could allow an authenticated user with management privileges to inject malicious scripts into the HAL Console web interface, potentially compromising the confidentiality and integrity of data viewed by other users. The vulnerability does not affect availability. Because exploitation requires authenticated access with elevated privileges, the attack surface is limited to authorized management users. However, the impact on confidentiality and integrity is rated high due to the nature of stored XSS attacks.

An official security update is available from Red Hat in JBoss Enterprise Application Platform 7.4.23 for both RHEL 7 and RHEL 8. Users should apply these updates to remediate the vulnerability. Before applying the update, ensure all previously released errata are applied and back up existing installations, including applications, configuration files, and databases. Follow the vendor's detailed upgrade instructions at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.