CVE-2022-39197
Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability
CVSS
—
Sin CVSS
EPSS
46.4%
p99
KEV
SÍ
30 mar 2023
Exploit Today
80
0-100
Publicado: — · Última mod.: —
Producto
Fortra / Cobalt Strike
Vulnerabilidad
Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability
Añadido a KEV
30 mar 2023
Remediar antes de
20 abr 2023
Uso conocido en ransomware
No
Descripción resumida
Fortra Cobalt Strike contains a cross-site scripting (XSS) vulnerability in Teamserver that would allow an attacker to set a malformed username in the Beacon configuration, allowing them to execute code remotely.
Acción requerida
Apply updates per vendor instructions.
Notas
https://www.cobaltstrike.com/blog/out-of-band-update-cobalt-strike-4-7-1/; https://nvd.nist.gov/vuln/detail/CVE-2022-39197