CVE-2022-30034

HIGH

Flower < 1.2.0 - Unauthenticated OAuth Authentication Bypass

Title source: llm

Description

Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass. An attacker could then access the Flower API to discover and invoke arbitrary Celery RPC calls or deny service by shutting down Celery task nodes.

References (3)

Core 3

Core References

Broken Link, URL Repurposed x_refsource_misc

http://githubcommherflower.com

Exploit, Third Party Advisory x_refsource_misc

https://tprynn.github.io/2022/05/26/flower-vulns.html

Exploit, Issue Tracking x_refsource_misc

https://github.com/mher/flower/issues/1217

Scores

CVSS v3 8.6

EPSS 0.0134

EPSS Percentile 67.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Details

CWE

CWE-287

Status published

Products (2)

flower_project/flower < 1.2.0

pypi/flower 0 - 1.2.0PyPI

Published Jun 02, 2022

Tracked Since Feb 18, 2026