Description
Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Selenium Grid < 4.0.0-alpha-7 - Remote Code Execution http/cves/2022/CVE-2022-28108.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.seleniumhq.selenium:selenium-grid | < 4.0.0-alpha-7 | 4.0.0-alpha-7 | GHSA-h2rr-m97p-6jq9 |
| Maven | org.seleniumhq.selenium:selenium-server | <= 4.0.0-alpha-2 | — | GHSA-h2rr-m97p-6jq9 |
| PyPI | selenium | < 4.0.0 | 4.0.0 | PYSEC-2022-43167 |