{"id":"CVE-2022-39197","kind":"vulnerability","aliases":["CVE-2022-39197"],"related":[],"title":"An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote…","description":"An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the Cobalt Strike teamserver. To exploit the vulnerability, one must first inspect a Cobalt Strike payload, and then modify the username field in the payload (or create a new payload with the extracted information and then modify that username field to be malformed).","summary":"Fortra Cobalt Strike Teamserver has a cross-site scripting flaw where a malformed username in the Beacon configuration can be used to run code remotely. CISA lists it as actively exploited in the wild.","severity":"high","cvss":6.1,"epss":null,"exploited":true,"exploited_at":"2023-03-30T00:00:00+00:00","products":[{"name":"Fortra Cobalt Strike","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"helpsystems cobalt strike","fixed":["4.7.1"],"affected":"< 4.7.1","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cobalt-strike","exploited","other","red-team","teamserver"],"not_affected_if":["not-running-teamserver"],"how_to_check":null,"fix":"Apply updates per vendor instructions (CISA KEV guidance); the specific fixed version is unknown from the sources.","status":"open","published_at":"2022-09-22T01:15:11+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:08:29+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-23T21:08:29Z","model":"claude-haiku-5-5","output":{"fix":"Apply updates per vendor instructions (CISA KEV guidance); the specific fixed version is unknown from the sources.","reach":"unknown","impact":"high","summary":"Fortra Cobalt Strike Teamserver has a cross-site scripting flaw where a malformed username in the Beacon configuration can be used to run code remotely. CISA lists it as actively exploited in the wild.","category":"other","who_cares":["cobalt-strike","red-team","teamserver"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs code remotely on the Teamserver host","analyst_note":"Find the fixed Cobalt Strike version and the affected version range from Fortra's advisory and the CISA KEV entry; confirm the attack vector and whether authentication is required.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["not-running-teamserver"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000461,"input_tokens":2837,"output_tokens":355,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2022':20A,23A '-39197':21A,24A '4.7':14A,88C 'activ':70B 'allow':16A,90C 'attack':93C 'beacon':57B 'cisa':66B 'cobalt':11A,26A,29A,32B,41B,85C,99C,111C 'cobalt-strik':31B 'code':64B 'configur':58B 'creat':124C 'cross':3A,47B,77C 'cross-sit':46B 'cve':19A,22A 'execut':95C 'exploit':34B,71B,103C 'extract':130C 'field':119C,137C 'first':108C 'flaw':50B 'fortra':25A,40B 'found':8A,82C 'helpsystem':10A,84C 'helpsystems':28A 'html':96C 'inform':131C 'inspect':109C 'list':67B 'malform':53B,140C 'modifi':116C,134C 'must':107C 'new':126C 'one':106C 'payload':113C,122C,127C 'red':37B 'red-team':36B 'remot':18A,65B,92C 'run':63B 'script':5A,49B,79C 'site':4A,48B,78C 'strike':12A,27A,30A,33B,42B,86C,100C,112C 'team':38B 'teamserv':39B,43B,101C 'use':61B 'usernam':54B,118C,136C 'vulner':6A,80C,105C 'wild':74B 'xss':2A,76C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-09-22T01:15:11+00:00","kev":{"dateAdded":"2023-03-30","dueDate":"2023-04-20","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-39197","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-39197","severity":null,"published_at":"2023-03-30T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T10:39:06+00:00","note":null},{"source":"nvd","external_id":"CVE-2022-39197","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39197","severity":null,"published_at":"2022-09-22T01:15:11+00:00","modified_at":"2026-06-17T04:57:53+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}