Read the docs
TI-2022-10914 Aliases CVE-2022-28108GHSA-h2rr-m97p-6jq9

Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types…

Priority MEDIUM 58CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-352.

Summary

Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain.

Why it matters now

EPSS 0.2254 97th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed org.seleniumhq.selenium:selenium-grid (Maven): 4.0.0-alpha-7

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.seleniumhq.selenium:selenium-grid (Maven)before 4.0.0-alpha-74.0.0-alpha-7Patch availableGHSA-h2rr-m97p-6jq9
—org.seleniumhq.selenium:selenium-server (Maven)up to 4.0.0-alpha-2—No fix listedGHSA-h2rr-m97p-6jq9
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.seleniumhq.selenium:selenium-grid (Maven) Vendor— Affected before 4.0.0-alpha-7 Fixed in 4.0.0-alpha-7 Patch available GHSA-h2rr-m97p-6jq9
  • org.seleniumhq.selenium:selenium-server (Maven) Vendor— Affected up to 4.0.0-alpha-2 Fixed in — No fix listed GHSA-h2rr-m97p-6jq9

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:selenium:selenium_grid:*:*:*:*:*:*:*:*before 4.0.0VulnerableSelenium
cpe:2.3:a:selenium:selenium_grid:4.0.0:-:*:*:*:*:*:*4.0.0VulnerableSelenium
cpe:2.3:a:selenium:selenium_grid:4.0.0:alpha1:*:*:*:*:*:*4.0.0 alpha1VulnerableSelenium
cpe:2.3:a:selenium:selenium_grid:4.0.0:alpha2:*:*:*:*:*:*4.0.0 alpha2VulnerableSelenium
cpe:2.3:a:selenium:selenium_grid:4.0.0:alpha3:*:*:*:*:*:*4.0.0 alpha3VulnerableSelenium
cpe:2.3:a:selenium:selenium_grid:4.0.0:alpha4:*:*:*:*:*:*4.0.0 alpha4VulnerableSelenium
cpe:2.3:a:selenium:selenium_grid:4.0.0:alpha5:*:*:*:*:*:*4.0.0 alpha5VulnerableSelenium
cpe:2.3:a:selenium:selenium_grid:4.0.0:alpha6:*:*:*:*:*:*4.0.0 alpha6VulnerableSelenium
  • cpe:2.3:a:selenium:selenium_grid:*:*:*:*:*:*:*:* Versions before 4.0.0 Vulnerable ·Selenium
  • cpe:2.3:a:selenium:selenium_grid:4.0.0:-:*:*:*:*:*:* Versions 4.0.0 Vulnerable ·Selenium
  • cpe:2.3:a:selenium:selenium_grid:4.0.0:alpha1:*:*:*:*:*:* Versions 4.0.0 alpha1 Vulnerable ·Selenium
  • cpe:2.3:a:selenium:selenium_grid:4.0.0:alpha2:*:*:*:*:*:* Versions 4.0.0 alpha2 Vulnerable ·Selenium
  • cpe:2.3:a:selenium:selenium_grid:4.0.0:alpha3:*:*:*:*:*:* Versions 4.0.0 alpha3 Vulnerable ·Selenium
  • cpe:2.3:a:selenium:selenium_grid:4.0.0:alpha4:*:*:*:*:*:* Versions 4.0.0 alpha4 Vulnerable ·Selenium
  • cpe:2.3:a:selenium:selenium_grid:4.0.0:alpha5:*:*:*:*:*:* Versions 4.0.0 alpha5 Vulnerable ·Selenium
  • cpe:2.3:a:selenium:selenium_grid:4.0.0:alpha6:*:*:*:*:*:* Versions 4.0.0 alpha6 Vulnerable ·Selenium

Remediation

  • Fix · GHSA-h2rr-m97p-6jq9 org.seleniumhq.selenium:selenium-grid (Maven) Fixed in 4.0.0-alpha-7 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-28108
  2. 2026-10-03 Alias added: GHSA-h2rr-m97p-6jq9

References

Exploit 1

Advisory 3

Other 4

  • TI-2020-14563 A cross-site scripting (XSS) vulnerability in Selenium Grid v3.141.59 allows attackers to… CVSS 3.1MEDIUM 6.1
  • TI-2022-10915 Selenium Selenium Grid (formerly Selenium Standalone Server) Fixed in 4.0.0-alpha-7 is… CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences