{"action":"Upgrade selenium to 4.0.0 or later.","affected":[{"fixed":"4.0.0","introduced":"0"}],"component":"selenium","cve_ids":["CVE-2022-28108"],"ecosystem":"PyPI","epss":0.2254,"exploited":false,"fixed_versions":["4.0.0"],"ghsa_id":"GHSA-h2rr-m97p-6jq9","id":"tcs_01M5KGHVD97MC56C5XRXP94TKZ","modified_at":"2024-11-22T21:12:10.893429Z","published_at":"2022-04-19T03:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2022-43167","https://www.gabriel.urdhr.fr/2022/02/07/selenium-standalone-server-csrf-dns-rebinding-rce/","https://www.selenium.dev/downloads/","https://www.openwall.com/lists/oss-security/2022/02/07/3"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"PYSEC-2022-43167","url":"https://osv.dev/vulnerability/PYSEC-2022-43167"}],"summary":"Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain."}