VULNERABILITY INTELLIGENCE

CVE-2022-42948

CVSS score9.8 CRITICAL

EPSS probability2.71%

CISA KEVKnown exploited vulnerability

Published2023-03-24

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Known Exploited Vulnerability

Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability

Vendor / product: Fortra / Cobalt Strike

Description

Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely execute code in the Cobalt Strike UI.

Weakness classification

nvd@nist.gov: CWE-116
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-116

Primary references

cve@mitre.org — Technical Description, Third Party Advisory
cve@mitre.org — Vendor Advisory
cve@mitre.org — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Technical Description, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — US Government Resource