Vulnerabilities

TI-2020-14563 CVE-2020-23452 · GHSA-8f3m-wpg8-3jw6

A cross-site scripting (XSS) vulnerability in Selenium Grid v3.141.59 allows attackers to…

MEDIUM 60

A cross-site scripting (XSS) vulnerability in Selenium Grid v3.141.59 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the hub parameter under the /grid/console page.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00406 Published 2023-07-05 No fix listed CWE-79

TI-2022-10914 CVE-2022-28108 · GHSA-h2rr-m97p-6jq9

Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types…

MEDIUM 58

Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.2254 Published 2022-04-19 Fixed in 4.0.0-alpha-7 CWE-352

TI-2022-10915 CVE-2022-28109 · GHSA-r2fp-xp6r-99gj

Selenium Selenium Grid (formerly Selenium Standalone Server) Fixed in 4.0.0-alpha-7 is…

MEDIUM 40

Selenium Selenium Grid (formerly Selenium Standalone Server) Fixed in 4.0.0-alpha-7 is affected by: DNS rebinding.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01115 Published 2022-04-15 Will not fix CWE-352

Vulnerabilities

Filters

A cross-site scripting (XSS) vulnerability in Selenium Grid v3.141.59 allows attackers to…

Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types…

Selenium Selenium Grid (formerly Selenium Standalone Server) Fixed in 4.0.0-alpha-7 is…