CVE-2022-42948

Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible...

Basic Information

CVE State: PUBLISHED
Reserved Date: October 14, 2022
Published Date: March 24, 2023
Last Updated: January 28, 2025
Vendor: n/a
Product: n/a
Description: Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely execute code in the Cobalt Strike UI.
Tags

CVSS Scores

CVSS v3.1

9.8 - CRITICAL

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC Information

Exploitation: active
Automatable: Yes
Technical Impact: total

Exploit Status

Exploited in the Wild: Yes (2023-03-30 00:00:00 UTC) Source

References

https://www.cobaltstrike.com/blog/ https://www.redpacketsecurity.com/helpsystems-cobalt-strike-code-execution-cve-2022-42948/ https://thesecmaster.com/how-to-fix-cve-2022-42948-a-critical-rce-vulnerability-in-cobalt-strike/

Known Exploited Vulnerability Information

Source	Added Date
CISA	2023-03-30 00:00:00 UTC

Timeline

CVE ID Reserved

October 14, 2022
CVE Published to Public

March 24, 2023
Added to KEVIntel

March 30, 2023