Vulnerabilities

TI-2022-12356 CVE-2022-30034 · GHSA-q4qm-xhf9-4p8f

Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is…

LOW 39

Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.01104 Published 2022-05-31 Fixed in 1.2.0 CWE-287

TI-2019-12624 CVE-2019-16925 · GHSA-q2hg-9256-vrxm

LOW 29

Flower 0.9.3 has XSS via the name parameter in an @app.task call.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00818 Published 2019-09-27 No fix listed CWE-79

TI-2019-12625 CVE-2019-16926 · GHSA-rvm9-vjh6-7fhr

LOW 29

Flower 0.9.3 has XSS via a crafted worker name.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00818 Published 2019-09-27 No fix listed CWE-79