CVE-2022-42948
Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing...
Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely execute code in the Cobalt Strike UI.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely execute code in the Cobalt Strike UI.
- Record
CVE-2022-42948- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-116
- Updated
- 2026-11-02
CVE List
Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely execute code in the Cobalt Strike UI.
- Record
CVE-2022-42948- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-116
- Updated
- 2026-11-02
EUVDEUVD-2022-46004
Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely execute code in the Cobalt Strike UI.
- Record
EUVD-2022-46004- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-c8qh-hq9w-qh3p
Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing...
Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely execute code in the Cobalt Strike UI.
- Record
GHSA-c8qh-hq9w-qh3p- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-79, CWE-116
- Updated
- 2026-11-02
CISA KEV No score
Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability
Fortra Cobalt Strike User Interface contains an unspecified vulnerability rooted in Java Swing that may allow remote code execution.
- Record
CVE-2022-42948- Weakness
- CWE-79, CWE-116
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-42948 is a critical vulnerability (CVSS 9.8) in Fortra Cobalt Strike, published March 24, 2023. CISA lists it as known to be exploited, since March 30, 2023. EUVD reports exploitation since March 30, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.71%, the 86th percentile. No source names a fixed version.
References
cobaltstrike.com/blog
redpacketsecurity.com/helpsystems-cobalt-strike-code-execution-cve-2022-42948
thesecmaster.com/how-to-fix-cve-2022-42948-a-critical-rce-vulnerability-in-cobalt-strike
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-42948
nvd.nist.gov/vuln/detail/CVE-2022-42948
github.com/advisories/GHSA-c8qh-hq9w-qh3p