CVE-2022-30034

Description

Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass. An attacker could then access the Flower API to discover and invoke arbitrary Celery RPC calls or deny service by shutting down Celery task nodes.

Risk Information

Base Score

8.6

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

EPSS Score

Exploitation Probability

0.226

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2022-30034 are fixed in Python-flower 1.2.0	Windows
Vulnerabilities CVE-2022-30034 are fixed in Python-flower for linux 1.2.0	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234