CVE-2022-28108: CSRF
Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain.
Other sources
Selenium Server (Grid) before 4.0.0-alpha-7 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.seleniumhq.selenium:selenium-gridto a version that resolves this vulnerability.Fixed in 4.0.0-alpha-7
Event History
Frequently Asked Questions
What is CVE-2022-28108?
CVE-2022-28108 is a vulnerability found in Selenium Server (Grid) before version 4 that allows CSRF due to the acceptance of non-JSON content types.
What is the severity of CVE-2022-28108?
CVE-2022-28108 has a severity level of critical with a CVSS score of 8.8.
Which versions of Selenium Grid are affected by CVE-2022-28108?
Versions up to and including 4.0.0-alpha6 of Selenium Grid are affected by CVE-2022-28108.
How can CSRF be exploited in Selenium Server (Grid) before version 4?
CSRF can be exploited in Selenium Server (Grid) before version 4 by sending requests with non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain.
Is there a fix available for CVE-2022-28108?
Yes, the fix for CVE-2022-28108 is to upgrade to Selenium Server (Grid) version 4.0.0 or later.