CVE-2022-39197

MediumCVSS 6.1/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the Cobalt Strike teamserver. To exploit the vulnerability, one must first inspect a Cobalt Strike payload, and then modify the username field in the payload (or create a new payload with the extracted information and then modify that username field to be malformed).

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.cobaltstrike.com/blog/out-of-band-update-cobalt-strike-4-7-1/Mitigation, Vendor Advisory
https://www.cobaltstrike.com/blog/tag/release/Release Notes, Vendor Advisory
https://www.cobaltstrike.com/blog/out-of-band-update-cobalt-strike-4-7-1/Mitigation, Vendor Advisory
https://www.cobaltstrike.com/blog/tag/release/Release Notes, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-39197US Government Resource

Timeline

Published: Sep 22, 2022
Last modified: Jun 17, 2026
Added to CISA KEV: Mar 30, 2023
NVD status: Analyzed

Related CVEs from 2022

CVE-2022-391989.8A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution.CVE-2022-391995.9immudb is a database with built-in cryptographic proof and verification. immudb client SDKs use server's UUID to distinguish between differe CVE-2022-39207.5HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC end CVE-2022-392005.3Dendrite is a Matrix homeserver written in Go. In affected versions events retrieved from a remote homeserver using the `/get_missing_events CVE-2022-392017.5Grafana is an open source observability and data visualization platform. Starting with version 5.0.0-beta1 and prior to versions 8.5.14 and CVE-2022-392026.3matrix-appservice-irc is an open source Node.js IRC bridge for Matrix. The Internet Relay Chat (IRC) protocol allows you to specify multiple CVE-2022-392038.8matrix-appservice-irc is an open source Node.js IRC bridge for Matrix. Attackers can specify a specific string of characters, which would co CVE-2022-392059.8Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. In versions of Onedev prior to 7.3.0 unauthenticated users can take CVE-2022-392069.9Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. When using Docker-based job executors, the Docker socket (e.g. /var/CVE-2022-392075.4Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. During CI/CD builds, it is possible to save build artifacts for late CVE-2022-392087.5Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. All files in the /opt/onedev/sites/ directory are exposed and can be CVE-2022-392096.5cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior to 0.29.0.gfm.6 a polyno