Selenium Grid vulnerabilities

2 known vulnerabilities in Selenium Grid from Selenium. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Selenium Grid: Cross-Site Request Forgery

  CVE-2022-28108Apr 19, 2022SeleniumEPSS 22.5%

  Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain.

• 8.8 High severity

  Selenium Grid: Cross-Site Request Forgery

  CVE-2022-28109Apr 15, 2022SeleniumEPSS 1.11%

  Selenium Selenium Grid (formerly Selenium Standalone Server) Fixed in 4.0.0-alpha-7 is affected by: DNS rebinding. The impact is: execute arbitrary code (remote). The component is: WebDriver endpoint of Selenium Grid / Selenium Standalone Server. The attack ve