Approved changes feed: RSS · Atom
cpe:2.3:a:flower_project:flower:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Flower Project (2e583b93-6a03-5c32-9d8a-218fa8810b92) |
|---|---|
| Product | Flower (7db88014-bdb1-5c18-bee1-9b82db4c8aa4) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:deb/debian/python-flower |
purl2cpe | 2026-06-01 10:17:54.399148 |
pkg:deb/ubuntu/python-flower |
purl2cpe | 2026-06-01 10:17:54.399150 |
pkg:docker/mher/flower |
purl2cpe | 2026-06-01 10:17:54.399156 |
pkg:github/mher/flower |
purl2cpe | 2026-06-01 10:17:54.399157 |
pkg:pypi/flower |
purl2cpe | 2026-06-01 10:17:54.399159 |
pkg:rpm/opensuse/python-flower |
purl2cpe | 2026-06-01 10:17:54.399160 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2022-51020 |
vulnerable | 2026-11-03 10:11:08.331675 |
Flower before 2.2.0 CSRF via Worker and Task Control API Endpoints
MEDIUM (5.9)
Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrf_cookies is disabled and the OAuth session cookie lacks SameSite. Attackers can lure authenticated users to malicious pages that POST to /api/worker/shutdown, /api/worker/pool/restart, or /api/task/revoke to shut down Celery workers, resize pools, and revoke tasks.
Published: 2026-10-12T20:55:06.611Z
Updated: 2026-10-15T13:49:48.409Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-30034 |
vulnerable | 2026-06-08 05:43:36.902755 |
Details available
Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass. An attacker could then access the Flower API to discover and invoke arbitrary Celery RPC calls or deny service by shutting down Celery task nodes.
Published: 2022-05-31T13:13:32.000Z
Updated: 2026-07-09T00:19:06.624Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.