CyberSecBulletin

Selenium vulnerabilities

We track 2 vulnerabilities in Selenium products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on April 19, 2022.

2vulnerabilities
0critical
2high
0exploited
8.8average CVSS score

Latest Selenium vulnerabilities

  • 8.8 High severity

    Selenium Grid: Cross-Site Request Forgery

    CVE-2022-28108SeleniumEPSS 22.5%

    Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain.

  • 8.8 High severity

    Selenium Grid: Cross-Site Request Forgery

    CVE-2022-28109SeleniumEPSS 1.11%

    Selenium Selenium Grid (formerly Selenium Standalone Server) Fixed in 4.0.0-alpha-7 is affected by: DNS rebinding. The impact is: execute arbitrary code (remote). The component is: WebDriver endpoint of Selenium Grid / Selenium Standalone Server. The attack ve