CVE-2022-28108
Selenium Server (Grid) CSRF
Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain.
- Record
CVE-2022-28108- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE List No score
Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain.
- Record
CVE-2022-28108- Updated
- 2026-11-02
EUVDEUVD-2022-0276 No score
Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain.
- Record
EUVD-2022-0276- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h2rr-m97p-6jq9
Selenium Server (Grid) CSRF
Selenium Server (Grid) before 4.0.0-alpha-7 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain.
- Record
GHSA-h2rr-m97p-6jq9- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
OSVGHSA-h2rr-m97p-6jq9
Selenium Server (Grid) CSRF
Selenium Server (Grid) before 4.0.0-alpha-7 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain.
- Record
GHSA-h2rr-m97p-6jq9- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
OSVPYSEC-2022-43167
Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain.
- Record
PYSEC-2022-43167- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV No score
Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain.
- Record
CVE-2022-28108- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.seleniumhq.selenium:selenium-gridMaven |
before 4.0.0-alpha-7 | 4.0.0-alpha-7 |
org.seleniumhq.selenium:selenium-serverMaven |
through 4.0.0-alpha-2 | None known |
org.seleniumhq.selenium:selenium-gridMaven |
before 4.0.0-alpha-7, plus listed versions 4.0.0-alpha-34.0.0-alpha-44.0.0-alpha-54.0.0-alpha-6 |
4.0.0-alpha-7 |
org.seleniumhq.selenium:selenium-serverMaven |
through 4.0.0-alpha-2, plus listed versions 2.0.02.0a12.0a22.0a42.0a5 Show 45 moreShow less2.0a62.0a72.0b12.0b22.0b32.0rc22.0rc32.1.02.10.02.11.02.12.02.13.02.14.02.15.02.16.02.16.12.17.02.18.02.19.02.2.02.20.02.21.02.22.02.23.02.23.12.24.12.25.02.26.02.27.02.28.02.29.02.29.12.3.02.3.12.30.02.31.02.32.02.33.02.34.02.35.02.36.02.37.02.37.12.38.02.39.0 |
None known |
seleniumPyPI |
before 4.0.0, plus listed versions 0.9.21.0.11.0.32.0-dev2.0-dev-9138 Show 45 moreShow less2.0-dev-92122.0-dev-92312.0-dev-92842.0-dev-93062.0-dev-93072.0-dev-93102.0-dev-93382.0-dev-93402.0-dev-93412.0-dev-94292.0.02.0.12.0a52.0b22.0b32.0b3dev2.0b4dev2.0dev12.0dev22.0dev32.0dev42.0dev52.0dev62.0rc12.0rc22.0rc32.1.02.10.02.11.02.11.12.12.02.12.12.13.02.13.12.14.02.15.02.16.02.17.02.18.12.19.02.19.12.2.02.20.02.21.02.21.1 |
4.0.0 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | Selenium Grid < 4.0.0-alpha-7 - Remote Code Execution |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, Nuclei, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-28108 is a high vulnerability (CVSS 8.8) in Selenium Grid, published April 19, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 22.5%, the 97th percentile. Fixed in org.seleniumhq.selenium:selenium-grid 4.0.0-alpha-7.
References
openwall.com/lists/oss-security/2022/02/07/3
gabriel.urdhr.fr/2022/02/07/selenium-standalone-server-csrf-dns-rebinding-rce
selenium.dev/downloads
nvd.nist.gov/vuln/detail/CVE-2022-28108
github.com/advisories/GHSA-h2rr-m97p-6jq9
Left out here: 166 versions. The JSON record has them.