Exploited Vulnerabilities DailyCVE-2022-39197: Fortra Cobalt Strike
EPSS46.4%No. 893 of 1739 in KEV
CVE year2022~1 yrs before listing
Same vendor in KEV4
Same product2
| Field | Value |
|---|---|
| Vendor | Fortra |
| Product | Cobalt Strike |
| Name | Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability |
| Added to KEV | 2023-03-30 |
| US federal due date | 2023-04-20 |
| Ransomware use | Unknown |
| CWE | CWE-20, CWE-79 |
CISA description
Fortra Cobalt Strike contains a cross-site scripting (XSS) vulnerability in Teamserver that would allow an attacker to set a malformed username in the Beacon configuration, allowing them to execute code remotely.
Other entries for this product
| CVE | Vendor / product | Added | EPSS | Ransomware |
|---|---|---|---|---|
| CVE-2022-42948 | Fortra Cobalt Strike | 2023-03-30 | 2.7% | Unknown |
Data from CISA's Known Exploited Vulnerabilities (KEV) catalog. EPSS is FIRST's estimated probability of exploitation activity in the next 30 days, refreshed weekly. Always follow the vendor's official guidance.
About this page
A Fortra Cobalt Strike vulnerability added to CISA's Known Exploited Vulnerabilities catalog on 2023-03-30.