Cobalt Strike issued another out of band update for their Server. This came shortly after the previous out of band update to 4.7.1, which fixed the Beacon username XSS CVE-2022-39197. In this context, security intelligence provides a detailed analysis of the latter. Version 4.7.2 fixes CVE-2022-42948: 4.7.1 still failed to escape HTML tags shown in Swing components, so injected HTML could run code in the Cobalt Strike UI.
