CVE-2022-51020

EUVD-2022-56064
Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrf_cookies is disabled and the OAuth session cookie lacks SameSite. Attackers can lure authenticated users to malicious pages that POST to /api/worker/shutdown, /api/worker/pool/restart, or /api/task/revoke to shut down Celery workers, resize pools, and revoke tasks.
CSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.9 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/mher/flower
https://github.com/mher/flower/blob/v2.1.0/flower/api/control.py#L25-L27
https://github.com/mher/flower/commit/3b2115af7f9c42bd2da2fbcbd919f77013e9ec51
https://github.com/mher/flower/commit/a14408b16cc3d2877d36659005ce0d72b6162629
https://github.com/mher/flower/issues/1217
https://www.vulncheck.com/advisories/flower-before-2.2.0-csrf-via-worker-and-task-control-api-endpoints