mher/flower

Releases28

Frequency4 months 3 weeks

Last Release almost 3 years ago

Stars7.19K

Real-time monitor and web admin for Celery distributed task queue

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2022-30034 ↗	Jun 2, 2022Thursday, 2 June 2022, 14:15	8.6 HIGH	7.5 HIGH
Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass. An attacker could then access the Flower API to discover and invoke arbitrary Celery RPC calls or deny service by shutting down Celery task nodes.