Descripción
Fortra Cobalt Strike contains a cross-site scripting (XSS) vulnerability in Teamserver that would allow an attacker to set a malformed username in the Beacon configuration, allowing them to execute code remotely.
Acción recomendada
Aplicar las actualizaciones según las instrucciones del fabricante.
Referencias
- Aviso de cobaltstrike.com cobaltstrike.com/blog/out-of-band-update-cobalt-strike-4-7-1/
- Ficha en NVD (NIST) nvd.nist.gov/vuln/detail/CVE-2022-39197
Otras vulnerabilidades de Fortra en el catálogo
- CVE-2025-10035 Vulnerabilidad de deserialización de datos no confiables en Fortra GoAnywhere MFT Alta 29-09-2025
- CVE-2022-42948 Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability Alta 30-03-2023
- CVE-2023-0669 Fortra GoAnywhere MFT Remote Code Execution Vulnerability Alta 10-02-2023