PT-2019-14872 · Celery · Flower

Published 2019-09-27 · Updated 2024-08-05 · CVE-2019-16925

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Flower version 0.9.3

Description The issue concerns a potential XSS via the name parameter in an @app.task call. However, the project author disputes the validity of this issue, stating that worker and task names are internal backend configuration options not facing users, and individuals with the rights to change them already possess full access.

Recommendations For Flower version 0.9.3, consider restricting access to the @app.task call to minimize potential risks, as the project author suggests that the configuration options in question are not user-facing and thus may not pose an external threat. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-16925

Affected Products

Flower

References · 4

• 🔥 https://fatihhcelik.blogspot.com/2019/09/flower-100-has-xss-via-name-parameter.html · Exploit
• https://osv.dev/vulnerability/CVE-2019-16925 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16925 · Security Note
• https://t.me/cvenotify/89096 · Telegram Post