CVE-2022-30034

2022-05-3113:13:32

mitre

www.cve.org

flower

web ui

celery python

oauth

authentication bypass

api

celery rpc calls

deny service

AI Score

8.9

Confidence

High

EPSS

0.002

Percentile

54.1%

JSON

Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass. An attacker could then access the Flower API to discover and invoke arbitrary Celery RPC calls or deny service by shutting down Celery task nodes.