CVE-2022-28108

Name of the Vulnerable Software and Affected Versions Selenium Server (Grid) versions prior to 4

Description The issue is related to a CSRF vulnerability in the Selenium Server (Grid) tool. It allows non-JSON content types, such as application/x-www-form-urlencoded, multipart/form-data, and text/plain, which can be exploited by a remote attacker to perform a CSRF attack.

Recommendations For versions prior to 4, update to version 4 or later to resolve the issue. As a temporary workaround, consider restricting the permitted content types to JSON only to minimize the risk of exploitation.