Flower Project

Records3All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high1CVSS 7.0–8.9

Exploited now

Flower Project records in CISA KEV

No Flower Project vulnerabilities are listed in CISA KEV.

Products in the NVD configurations · select one to filter the records

3 records in Flower · all components

TI-2022-12356 CVE-2022-30034 · GHSA-q4qm-xhf9-4p8f

LOW 39

Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.01104 Published 2022-05-31 Fixed in 1.2.0 CWE-287

TI-2019-12625 CVE-2019-16926 · GHSA-rvm9-vjh6-7fhr

LOW 29

Flower 0.9.3 has XSS via a crafted worker name.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00818 Published 2019-09-27 No fix listed CWE-79

TI-2019-12624 CVE-2019-16925 · GHSA-q2hg-9256-vrxm

LOW 29

Flower 0.9.3 has XSS via the name parameter in an @app.task call.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00818 Published 2019-09-27 No fix listed CWE-79