GHSA-f7jh-m6wp-jm7f: XSS
First published: Tue May 06 2025(Updated: )
A flaw was found in the JBoss EAP Management Console, where a stored Cross-site scripting vulnerability occurs when an application improperly sanitizes user input before storing it in a data store. When this stored data is later included in web pages without adequate sanitization, malicious scripts can execute in the context of users who view these pages, leading to potential data theft, session hijacking, or other malicious activities. ### Impact Cross-site scripting (XSS) vulnerability in the management console. ### Patches Fixed in [HAL 3.7.11.Final](https://github.com/hal/console/releases/tag/v3.7.11) ### Workarounds No workaround available
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.jboss.hal:hal-console | <3.7.11.Final | 3.7.11.Final |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/hal/console/security/advisories/GHSA-f7jh-m6wp-jm7f
- https://nvd.nist.gov/vuln/detail/CVE-2025-2901
- https://github.com/hal/console/commit/216de3b8aa82ea92df10cc296d88c68467cf2c52
- https://access.redhat.com/security/cve/CVE-2025-2901
- https://bugzilla.redhat.com/show_bug.cgi?id=2355685
- https://github.com/hal/console/releases/tag/v3.7.11
- https://github.com/advisories/GHSA-f7jh-m6wp-jm7f (Advisory)
Frequently Asked Questions
What is the severity of GHSA-f7jh-m6wp-jm7f?
GHSA-f7jh-m6wp-jm7f is identified as a stored Cross-site Scripting (XSS) vulnerability that can lead to significant security risks.
How do I fix GHSA-f7jh-m6wp-jm7f?
To fix GHSA-f7jh-m6wp-jm7f, upgrade the JBoss EAP Management Console to version 3.7.11.Final or later.
What impact does GHSA-f7jh-m6wp-jm7f have on my application?
GHSA-f7jh-m6wp-jm7f allows attackers to inject malicious scripts that can execute in a user's browser, potentially compromising user data.
Who is affected by GHSA-f7jh-m6wp-jm7f?
GHSA-f7jh-m6wp-jm7f affects applications using the JBoss EAP Management Console version prior to 3.7.11.Final.
How was GHSA-f7jh-m6wp-jm7f discovered?
GHSA-f7jh-m6wp-jm7f was discovered due to inadequate sanitization of user input before being stored in the application.
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-f7jh-m6wp-jm7f
- alias/CVE-2025-2901
- agent/software-canonical-lookup
- agent/weakness
- agent/last-modified-date
- agent/severity
- agent/source
- agent/references
- agent/softwarecombine
- agent/tags
- agent/type
- agent/description
- agent/first-publish-date
- agent/event
- package-manager/maven