CVE-2022-42948

Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible...

Basic Information

CVE State: PUBLISHED
Reserved Date: October 14, 2022
Published Date: March 24, 2023
Last Updated: January 28, 2025
Vendor: n/a
Product: n/a
Description: Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely execute code in the Cobalt Strike UI.

CVSS Scores

CVSS v3.1

9.8 - CRITICAL

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC Information

Exploitation: active
Automatable: Yes
Technical Impact: total

Exploit Status

Exploited in the Wild: Yes (added 2023-03-30 00:00:00 UTC) Source

References

https://www.cobaltstrike.com/blog/ https://www.redpacketsecurity.com/helpsystems-cobalt-strike-code-execution-cve-2022-42948/ https://thesecmaster.com/how-to-fix-cve-2022-42948-a-critical-rce-vulnerability-in-cobalt-strike/

Known Exploited Vulnerability Information

Source	Added Date
CISA	2023-03-30 00:00:00 UTC