Helpsystems: community verdicts
2 notable / known-exploited Helpsystems CVEs the community has triaged.
ⓘ Not an exhaustive list: we focus on the findings that matter (exploited / notable). For every Helpsystems CVE, see NVD ↗.
Show as table
| Year published | CVEs | In CISA KEV |
|---|---|---|
| 2022 | 1 | 1 |
| 2023 | 1 | 1 |
Exploitation first, with newly exploited CVEs rising above old ones
- CVE-2022-39197MED 6.1KEVEPSS 44%
An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the Cobalt Strike teamserver. To exploit the vulnerability, one must first inspect a Cobalt Strike payload, and then modify the username field in the payload (or create a new payload with the extracted information and then modify that username field to be malformed).
- CVE-2022-42948CRIT 9.8KEVEPSS 3%
Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely execute code in the Cobalt Strike UI.