{"id":"CVE-2022-28108","aliases":["EUVD-2022-0276","GHSA-h2rr-m97p-6jq9","PYSEC-2022-43167"],"status":"published","title":"Selenium Server (Grid) CSRF","description":"Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.2254,"percentile":0.97725,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-352"],"published":"2022-04-19T02:55:37Z","modified":"2026-10-28T02:31:14Z","exploits":[{"source":"nuclei","id":"CVE-2022-28108","title":"Selenium Grid \u003c 4.0.0-alpha-7 - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-28108.yaml"}],"fixes":[{"ecosystem":"Maven","package":"org.seleniumhq.selenium:selenium-grid","fixed_in":["4.0.0-alpha-7"],"sources":["ghsa","osv"]},{"ecosystem":"PyPI","package":"selenium","fixed_in":["4.0.0"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.seleniumhq.selenium:selenium-grid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-alpha-7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.seleniumhq.selenium:selenium-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.0.0-alpha-2"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.seleniumhq.selenium:selenium-grid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-alpha-7"}]}],"versions":["4.0.0-alpha-3","4.0.0-alpha-4","4.0.0-alpha-5","4.0.0-alpha-6"]},{"source":"osv","ecosystem":"Maven","package":"org.seleniumhq.selenium:selenium-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.0.0-alpha-2"}]}],"versions":["2.0.0","2.0a1","2.0a2","2.0a4","2.0a5","2.0a6","2.0a7","2.0b1","2.0b2","2.0b3","2.0rc2","2.0rc3","2.1.0","2.10.0","2.11.0","2.12.0","2.13.0","2.14.0","2.15.0","2.16.0","2.16.1","2.17.0","2.18.0","2.19.0","2.2.0","2.20.0","2.21.0","2.22.0","2.23.0","2.23.1","2.24.1","2.25.0","2.26.0","2.27.0","2.28.0","2.29.0","2.29.1","2.3.0","2.3.1","2.30.0","2.31.0","2.32.0","2.33.0","2.34.0","2.35.0","2.36.0","2.37.0","2.37.1","2.38.0","2.39.0","2.4.0","2.40.0","2.41.0","2.42.0","2.42.1","2.42.2","2.43.0","2.43.1","2.44.0","2.45.0","2.46.0","2.47.0","2.47.1","2.47.2","2.48.0","2.48.1","2.48.2","2.49.0","2.49.1","2.5.0","2.50.0","2.50.1","2.51.0","2.52.0","2.53.0","2.53.1","2.6.0","2.7.0","2.8.0","2.9.0","3.0.0","3.0.0-beta1","3.0.0-beta2","3.0.0-beta3","3.0.0-beta4","3.0.1","3.1.0","3.10.0","3.11.0","3.12.0","3.13.0","3.14.0","3.141.0","3.141.5","3.141.59","3.2.0","3.3.0","3.3.1","3.4.0","3.5.1","3.5.2","3.5.3","3.6.0","3.7.0","3.7.1","3.8.0","3.8.1","3.9.0","3.9.1","4.0.0-alpha-1","4.0.0-alpha-2"]},{"source":"osv","ecosystem":"PyPI","package":"selenium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0"}]}],"versions":["0.9.2","1.0.1","1.0.3","2.0-dev","2.0-dev-9138","2.0-dev-9212","2.0-dev-9231","2.0-dev-9284","2.0-dev-9306","2.0-dev-9307","2.0-dev-9310","2.0-dev-9338","2.0-dev-9340","2.0-dev-9341","2.0-dev-9429","2.0.0","2.0.1","2.0a5","2.0b2","2.0b3","2.0b3dev","2.0b4dev","2.0dev1","2.0dev2","2.0dev3","2.0dev4","2.0dev5","2.0dev6","2.0rc1","2.0rc2","2.0rc3","2.1.0","2.10.0","2.11.0","2.11.1","2.12.0","2.12.1","2.13.0","2.13.1","2.14.0","2.15.0","2.16.0","2.17.0","2.18.1","2.19.0","2.19.1","2.2.0","2.20.0","2.21.0","2.21.1","2.21.2","2.21.3","2.22.0","2.22.1","2.23.0","2.24.0","2.25.0","2.26.0","2.27.0","2.28.0","2.29.0","2.3.0","2.30.0","2.31.0","2.32.0","2.33.0","2.34.0","2.35.0","2.36.0","2.37.0","2.37.1","2.37.2","2.38.0","2.38.1","2.38.2","2.38.3","2.38.4","2.39.0","2.4.0","2.40.0","2.41.0","2.42.0","2.42.1","2.43.0","2.44.0","2.45.0","2.46.0","2.46.1","2.47.0","2.47.1","2.47.2","2.47.3","2.48.0","2.49.0","2.49.1","2.49.2","2.5.0","2.50.0","2.50.1","2.51.0","2.51.1","2.52.0","2.53.0","2.53.1","2.53.2","2.53.3","2.53.4","2.53.5","2.53.6","2.6.0","2.7.0","2.8.0","2.8.1","2.9.0","3.0.0","3.0.0b1","3.0.0b2","3.0.0b3","3.0.1","3.0.2","3.10.0","3.11.0","3.12.0","3.13.0","3.14.0","3.14.1","3.141.0","3.3.0","3.3.1","3.3.2","3.3.3","3.4.0","3.4.1","3.4.2","3.4.3","3.5.0","3.6.0","3.7.0","3.8.0","3.8.1","3.9.0","4.0.0.a7","4.0.0.b1","4.0.0.b2","4.0.0.b2.post1","4.0.0.b3","4.0.0.b4","4.0.0.rc1","4.0.0a1","4.0.0a3","4.0.0a5","4.0.0a6","4.0.0a6.post1","4.0.0a6.post2","4.0.0rc2","4.0.0rc3"]}],"products":[{"vendor":"selenium","product":"selenium_grid"}],"references":[{"url":"https://www.openwall.com/lists/oss-security/2022/02/07/3","tags":["x_refsource_MISC","x_transferred","Mailing List","Not Applicable","Third Party Advisory","web"]},{"url":"https://www.gabriel.urdhr.fr/2022/02/07/selenium-standalone-server-csrf-dns-rebinding-rce/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://www.selenium.dev/downloads/","tags":["x_refsource_MISC","x_transferred","Product","Vendor Advisory","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28108","tags":["advisory"]},{"url":"https://www.gabriel.urdhr.fr/2022/02/07/selenium-standalone-server-csrf-dns-rebinding-rce","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2022/04/14/2","tags":["web"]},{"url":"https://www.selenium.dev/downloads","tags":["web"]},{"url":"https://github.com/advisories/GHSA-h2rr-m97p-6jq9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/28xxx/CVE-2022-28108.json","tags":["advisory"]},{"url":"https://github.com/SeleniumHQ/selenium","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-28108","description":"Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain.","status":"published","published":"2022-04-19T02:55:37Z","modified":"2024-08-03T05:48:36.815Z","updated_at":"2026-11-02T14:34:39.233406Z"}],"euvd":[{"id":"EUVD-2022-0276","description":"Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain.","status":"published","published":"2022-04-19T02:55:37Z","modified":"2024-08-03T05:48:36Z","updated_at":"2026-11-03T03:25:41.471197Z"}],"ghsa":[{"id":"GHSA-h2rr-m97p-6jq9","title":"Selenium Server (Grid) CSRF","description":"Selenium Server (Grid) before 4.0.0-alpha-7 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain.","status":"published","published":"2022-04-20T00:00:34Z","modified":"2025-04-02T13:51:41Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:38:37.325334Z"}],"nvd":[{"id":"CVE-2022-28108","description":"Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain.","status":"published","published":"2022-04-19T03:15:08.74Z","modified":"2026-06-17T04:38:00.433Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:07:16.9948Z"}],"osv":[{"id":"GHSA-h2rr-m97p-6jq9","title":"Selenium Server (Grid) CSRF","description":"Selenium Server (Grid) before 4.0.0-alpha-7 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain.","status":"published","published":"2022-04-20T00:00:34Z","modified":"2026-09-10T03:49:28.839291315Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:46:48.546324Z"},{"id":"PYSEC-2022-43167","description":"Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain.","status":"published","published":"2022-04-19T03:15:00Z","modified":"2024-11-22T21:12:10.893429Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:53.449407Z"},{"id":"CVE-2022-28108","description":"Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain.","status":"published","published":"2022-04-19T02:55:37Z","modified":"2026-10-28T02:31:14.846044459Z","updated_at":"2026-11-02T15:44:25.164673Z"}]}}