PT-2019-14873 · Celery · Flower

Published 2019-09-27 · Updated 2024-08-05 · CVE-2019-16926

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Flower version 0.9.3

Description The issue concerns a potential XSS vulnerability via a crafted worker name. However, the project author disputes its validity, stating that worker and task names are internal backend configuration options not facing users, and individuals with the rights to change them already have full access.

Recommendations For Flower version 0.9.3, consider restricting access to internal backend configuration options to minimize potential risks, as the project author suggests that individuals with access to these options already have full access to the system. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-16926

Affected Products

Flower

References · 4

• 🔥 https://fatihhcelik.blogspot.com/2019/09/flower-100-has-xss-via-crafted-worker.html · Exploit
• https://osv.dev/vulnerability/CVE-2019-16926 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16926 · Security Note
• https://t.me/cvenotify/89097 · Telegram Post