CVE-2022-30034 json
Flower OAuth authentication bypass
published 2022-05-31 4 y ago modified 2026-07-09 4 mo ago also GHSA-q4qm-xhf9-4p8f , PYSEC-2022-42973 , EUVD-2022-0106
- cvss
- 8.6
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.1%
- EPSS 1.1% chance of exploitation in 30 days, percentile 65%
- public exploits
- 0
- none known
Summary
Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass. An attacker could then access the Flower API to discover and invoke arbitrary Celery RPC calls or deny service by shutting down Celery task nodes.
Patch / fix
Exploit prediction
1.10% chance of exploitation in the next 30 days, higher than 65% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- tprynn.github.io https://tprynn.github.io/2022/05/26/flower-vulns.html referenced PoC, tagged "exploit" by a source, unverified
- github.com https://github.com/mher/flower/issues/1217 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| GitHub | 3.1 | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | flower | <1.2.0 |
1.2.0 |
Classification
- Weakness
-
- CWE-287 Improper Authentication
References
-
github.com
/mher/flower/pull/1216
web
-
tprynn.github.io
/2022/05/26/flower-vulns.html
web, exploit, third-party-advisory, evidence
-
github.com
/mher/flower/issues/1217
web, exploit, issue-tracking, report
-
nvd.nist.gov
/vuln/detail/CVE-2022-30034
advisory
-
github.com
/mher/flower
package
-
github.com
/pypa/advisory-database/tree/main/vulns/flower/PYSEC-2022-42973.yaml
web
-
githubcommherflower.com
web
-
github.com
/advisories/GHSA-q4qm-xhf9-4p8f
advisory
Sources
- CVE List CVE-2022-30034
- GitHub Advisory GHSA-q4qm-xhf9-4p8f
- NVD CVE-2022-30034
- OSV PYSEC-2022-42973
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.