{"id":"CVE-2022-42948","kind":"vulnerability","aliases":["CVE-2022-42948"],"related":[],"title":"helpsystems cobalt strike: Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components","description":"Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely execute code in the Cobalt Strike UI.","summary":"Fortra Cobalt Strike's user interface has a flaw in its Java Swing code that allows remote code execution. CISA lists it as actively exploited in the wild.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2023-03-30T00:00:00+00:00","products":[{"name":"Fortra Cobalt Strike","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"helpsystems cobalt strike","fixed":[],"affected":"= 4.7.1","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cobalt-strike","exploited","java","package"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the vendor update per Fortra's instructions; the sources do not name a fixed version.","status":"open","published_at":"2023-03-24T14:15:09+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:08:30+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-23T21:08:30Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor update per Fortra's instructions; the sources do not name a fixed version.","reach":"unknown","impact":"high","summary":"Fortra Cobalt Strike's user interface has a flaw in its Java Swing code that allows remote code execution. CISA lists it as actively exploited in the wild.","category":"package","who_cares":["cobalt-strike","java"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker runs code on the machine running the Cobalt Strike client.","analyst_note":"Find the fixed version and the exposure conditions in Fortra's advisory for CVE-2022-42948; the KEV entry only says apply vendor updates.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000438,"input_tokens":2801,"output_tokens":316,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2022':21A,24A '-42948':22A,25A '4.7.1':6A,68C 'activ':61B 'allow':53B 'cisa':57B 'cobalt':2A,4A,27A,30A,33B,39B,66C,96C 'cobalt-strik':32B 'code':51B,55B,86C,93C 'compon':19A,81C 'craft':84C 'cve':20A,23A 'display':16A,78C 'escap':10A,72C 'execut':56B,92C 'exploit':35B,62B 'fail':7A,69C 'flaw':46B 'fortra':26A,38B 'helpsystem':1A 'helpsystems':29A 'html':11A,73C,85C 'inject':83C 'interfac':43B 'java':36B,49B 'list':58B 'packag':37B 'possibl':89C 'proper':9A,71C 'remot':54B,91C 'strike':3A,5A,28A,31A,34B,40B,67C,97C 'swing':18A,50B,80C 'tag':12A,74C 'ui':98C 'user':42B 'wild':65B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-03-24T14:15:09+00:00","kev":{"dateAdded":"2023-03-30","dueDate":"2023-04-20","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-42948","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-42948","severity":null,"published_at":"2023-03-30T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T14:39:39+00:00","note":null},{"source":"nvd","external_id":"CVE-2022-42948","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42948","severity":null,"published_at":"2023-03-24T14:15:09+00:00","modified_at":"2026-06-17T05:05:39+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}