CVE-2022-39197
KEVFortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability
View CVE record →- Vendor / Project
- Fortra
- Product
- Cobalt Strike
- Date added
- Mar 30, 2023
- Due date
- Apr 20, 2023
- Known ransomware use
- Unknown
- CWEs
- CWE-20, CWE-79
Description
Fortra Cobalt Strike contains a cross-site scripting (XSS) vulnerability in Teamserver that would allow an attacker to set a malformed username in the Beacon configuration, allowing them to execute code remotely.
Required action
Apply updates per vendor instructions.