CVE-2022-28109

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Selenium Selenium Grid (formerly Selenium Standalone Server) Fixed in 4.0.0-alpha-7 is affected by: DNS rebinding. The impact is: execute arbitrary code (remote). The component is: WebDriver endpoint of Selenium Grid / Selenium Standalone Server. The attack vector is: Triggered by browsing to to a malicious remote web server. The WebDriver endpoint of Selenium Server (Grid) is vulnerable to DNS rebinding. This can be used to execute arbitrary code on the machine.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Apr 15, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-28116.1A vulnerability classified as problematic has been found in SourceCodester Guest Management System. This affects an unknown part of the file CVE-2022-281109.8Hotel Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at the login page.CVE-2022-281119.8MyBatis PageHelper v1.x.x-v3.7.0 v4.0.0-v5.0.0,v5.1.0-v5.3.0 was discovered to contain a time-blind SQL injection vulnerability via the orde CVE-2022-281137.2An issue in upload.csp of FANTEC GmbH MWiD25-DS Firmware v2.000.030 allows attackers to write files and reset the user passwords without hav CVE-2022-281149.1DSCMS v3.0 was discovered to contain an arbitrary file deletion vulnerability via /controller/Adv.php.CVE-2022-281159.8Online Sports Complex Booking v1.0 was discovered to contain a SQL injection vulnerability via the id parameter.CVE-2022-281169.8Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter.CVE-2022-281174.9A Server-Side Request Forgery (SSRF) in feed_parser class of Navigate CMS v2.9.4 allows remote attackers to force the application to make ar CVE-2022-281189.8SiteServer CMS v7.x allows attackers to execute arbitrary code via a crafted plug-in.CVE-2022-28129.8A vulnerability classified as critical was found in SourceCodester Guest Management System. This vulnerability affects unknown code of the f CVE-2022-281209.8Beijing Runnier Network Technology Co., Ltd Open virtual simulation experiment teaching management platform software 2.0 has a file upload v CVE-2022-281268.2Improper input validation in some Intel(R) XMM(TM) 7560 Modem software before version M2_7560_R_01.2146.00 may allow a privileged user to po