CVE-2022-28109 | BDVDB-2026-174282 Detail

Description#

Selenium Selenium Grid (formerly Selenium Standalone Server) Fixed in 4.0.0-alpha-7 is affected by: DNS rebinding. The impact is: execute arbitrary code (remote). The component is: WebDriver endpoint of Selenium Grid / Selenium Standalone Server. The attack vector is: Triggered by browsing to to a malicious remote web server. The WebDriver endpoint of Selenium Server (Grid) is vulnerable to DNS rebinding. This can be used to execute arbitrary code on the machine.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://www.openwall.com/lists/oss-security/2022/02/07/3
https://www.gabriel.urdhr.fr/2022/02/07/selenium-standalone-server-csrf-dns-rebinding-rce/
http://www.openwall.com/lists/oss-security/2022/04/16/1

Exploit#

No public exploit known

History#

Version 12022-04-15Record published in the CVE List.
Version 22024-08-03Most recent update recorded in the CVE List.