Java| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|
| org.jboss.hal:hal-console | maven | < 3.7.7.Final | 3.7.7.Final |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper input neutralization in user-controllable values displayed in the web UI. The patch version 3.7.7.Final explicitly lists HAL-1996 ('Fix placeholder value handling') as a fix, and placeholders are common XSS vectors when unescaped. While the exact code isn't available, the combination of CWE-79 classification, patch notes referencing placeholder handling improvements, and the XSS impact pattern strongly suggests vulnerable placeholder processing functions in the client-side rendering logic.
KEV Misses 88% of Exploited CVEs- Get the report
