CVE-2022-28108

Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain.

Score

CVSS 3.1 8.8 High

Status

Modified - cve@mitre.org

Published

2022-04-19

Last modified

2024-08-03

Weaknesses

CWE-352

Affected products

• Selenium Grid (Selenium)

References

• https://www.gabriel.urdhr.fr/2022/02/07/selenium-standalone-server-csrf-dns-rebinding-rce/
• https://www.openwall.com/lists/oss-security/2022/02/07/3
• https://www.selenium.dev/downloads/