Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain.
References
| Link | Resource |
|---|---|
| https://www.gabriel.urdhr.fr/2022/02/07/selenium-standalone-server-csrf-dns-rebinding-rce/ | Exploit Third Party Advisory |
| https://www.openwall.com/lists/oss-security/2022/02/07/3 | Mailing List Not Applicable Third Party Advisory |
| https://www.selenium.dev/downloads/ | Product Vendor Advisory |
| https://www.gabriel.urdhr.fr/2022/02/07/selenium-standalone-server-csrf-dns-rebinding-rce/ | Exploit Third Party Advisory |
| https://www.openwall.com/lists/oss-security/2022/02/07/3 | Mailing List Not Applicable Third Party Advisory |
| https://www.selenium.dev/downloads/ | Product Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 06:56
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.gabriel.urdhr.fr/2022/02/07/selenium-standalone-server-csrf-dns-rebinding-rce/ - Exploit, Third Party Advisory | |
| References | () https://www.openwall.com/lists/oss-security/2022/02/07/3 - Mailing List, Not Applicable, Third Party Advisory | |
| References | () https://www.selenium.dev/downloads/ - Product, Vendor Advisory |
27 Apr 2022, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 9.3
v3 : 8.8 |
| CWE | CWE-352 | |
| CPE | cpe:2.3:a:selenium:selenium_grid:4.0.0:alpha2:*:*:*:*:*:* cpe:2.3:a:selenium:selenium_grid:4.0.0:-:*:*:*:*:*:* cpe:2.3:a:selenium:selenium_grid:4.0.0:alpha4:*:*:*:*:*:* cpe:2.3:a:selenium:selenium_grid:4.0.0:alpha6:*:*:*:*:*:* cpe:2.3:a:selenium:selenium_grid:4.0.0:alpha5:*:*:*:*:*:* cpe:2.3:a:selenium:selenium_grid:*:*:*:*:*:*:*:* cpe:2.3:a:selenium:selenium_grid:4.0.0:alpha3:*:*:*:*:*:* cpe:2.3:a:selenium:selenium_grid:4.0.0:alpha1:*:*:*:*:*:* |
|
| References | (MISC) https://www.gabriel.urdhr.fr/2022/02/07/selenium-standalone-server-csrf-dns-rebinding-rce/ - Exploit, Third Party Advisory | |
| References | (MISC) https://www.openwall.com/lists/oss-security/2022/02/07/3 - Mailing List, Not Applicable, Third Party Advisory | |
| References | (MISC) https://www.selenium.dev/downloads/ - Product, Vendor Advisory |
19 Apr 2022, 04:14
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-04-19 03:15
Updated : 2024-11-21 06:56
NVD link : CVE-2022-28108
Mitre link : CVE-2022-28108
CVE.ORG link : CVE-2022-28108
JSON object : View
Products Affected
selenium
- selenium_grid
CWE
CWE-352
Cross-Site Request Forgery (CSRF)