GitHub Advisoryadvisory · Maven

GHSA-h2rr-m97p-6jq9 Selenium Server (Grid) CSRF

HIGH Published 2022-04-20 Modified 2025-04-02 Official page ↗
Aliases
CVE-2022-28108
Ecosystem
Maven
Packages
org.seleniumhq.selenium:selenium-grid, org.seleniumhq.selenium:selenium-server
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
Reviewed
2024-11-22

Affected packages

• Maven org.seleniumhq.selenium:selenium-grid: < 4.0.0-alpha-7 → fixed in 4.0.0-alpha-7 • Maven org.seleniumhq.selenium:selenium-server: <= 4.0.0-alpha-2 (no fix yet)

Description

Selenium Server (Grid) before 4.0.0-alpha-7 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain.

Related

Alias · CVE (1)

  • CVE-2022-28108 Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded,… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References