CVE-2022-39197

helpsystems cobalt strike

Published 22 Sept 2022 · updated 17 Jun 2026 · Analyzed

6.1 Medium · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 30 Mar 2023, with a remediation deadline of 20 Apr 2023 for US federal agencies.

Required action: Apply updates per vendor instructions.

Description

An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the Cobalt Strike teamserver. To exploit the vulnerability, one must first inspect a Cobalt Strike payload, and then modify the username field in the payload (or create a new payload with the extracted information and then modify that username field to be malformed).

References

www.cobaltstrike.com/blog/out-of-band-update-cobalt-strike-4-7-1/ · Mitigation, Vendor Advisory
www.cobaltstrike.com/blog/tag/release/ · Release Notes, Vendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-39197 · US Government Resource