CrowdSecLive Exploit Tracker
Limited ExploitationCVE-2022-28108Public Exploit

Selenium Server (Grid) - Improper Access Control (CVE-2022-28108)

PublishedApr 19, 2022
First SeenN/A
Last Seen
Reported
CVSS8.8
S
SeleniumSelenium Server (Grid)
web_application

Description

Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain.

psychologyCrowdSec Analysis

CVE-2022-28108 is a cross-site request forgery (CSRF) vulnerability in Selenium Server (Grid) versions before 4, caused by accepting non-JSON content types such as form data and plain text. An attacker may trick an authenticated user into submitting a crafted request, potentially compromising the confidentiality, integrity, and availability of the affected server.

CrowdSec has been tracking this vulnerability and its exploits since 20th of October 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2022-28108 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers target Selenium Grid instances by posting crafted session-creation requests to /wd/hub/session. The request injects commands through Chrome capabilities, potentially enabling remote code execution by the Grid process.

lock

Full Intelligence Available

Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.

EventDate
CVE Published2022-04-19
Rule Released2026-10-20

Related Weaknesses

CWE-352: Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

arrow_forward

Remediation & Protection

lock to download blocklists, subscribe to firewalls, and access IP intelligence.

External References