CVE-2022-30034

Published June 2nd, 2022

View on NVD ↗

CVSS v3

8.6

HIGH

CVSS v2

7.5

HIGH

Affected

PROJECT

Description

Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass. An attacker could then access the Flower API to discover and invoke arbitrary Celery RPC calls or deny service by shutting down Celery task nodes.

mher/flower

Real-time monitor and web admin for Celery distributed task queue

GitHub

7.19K