CVE-2022-30034

Published: Jun 2, 2022Modified: Jul 9, 2026

8.6

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Exploitability: 3.9 / Impact: 4.7

Source: NVD

Description

Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass. An attacker could then access the Flower API to discover and invoke arbitrary Celery RPC calls or deny service by shutting down Celery task nodes.

Affected (1)

Products: Flower Project: Flower

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Flower Project Flower	Before 1.2.0

Related CWEs

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (4)

https://github.com/mher/flower/issues/1217

Source: cve@mitre.org

ExploitIssue Tracking

https://tprynn.github.io/2022/05/26/flower-vulns.html

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/mher/flower/issues/1217

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitIssue Tracking

https://tprynn.github.io/2022/05/26/flower-vulns.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.