CVEvulnerability
CVE-2022-42948
CISA Known Exploited Vulnerability
Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability — Fortra Cobalt Strike
Fortra Cobalt Strike User Interface contains an unspecified vulnerability rooted in Java Swing that may allow remote code execution.
- Added to KEV
- 2023-03-30
- Remediation due
- 2023-04-20
- Ransomware use
- Unknown
- Required action
- Apply updates per vendor instructions.
- Notes
- https://www.cobaltstrike.com/blog/out-of-band-update-cobalt-strike-4-7-2/; https://nvd.nist.gov/vuln/detail/CVE-2022-42948
- Status
- Analyzed
- Published
- 2023-03-24
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-116
Description
Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely execute code in the Cobalt Strike UI.
Affected configurations
• helpsystems cobalt strike 4.7.1
Related
Weakness · CWE (1)
- CWE-116 Improper Encoding or Escaping of Output weakness
References
- https://thesecmaster.com/how-to-fix-cve-2022-42948-a-critical-rce-vulnerability-in-cobalt-strike/ Technical Description, Third Party Advisory
- https://www.cobaltstrike.com/blog/ Vendor Advisory
- https://www.redpacketsecurity.com/helpsystems-cobalt-strike-code-execution-cve-2022-42948/ Third Party Advisory
- https://thesecmaster.com/how-to-fix-cve-2022-42948-a-critical-rce-vulnerability-in-cobalt-strike/ Technical Description, Third Party Advisory
- https://www.cobaltstrike.com/blog/ Vendor Advisory
- https://www.redpacketsecurity.com/helpsystems-cobalt-strike-code-execution-cve-2022-42948/ Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-42948 US Government Resource