Skip to content
OpenAdvisories

Vendor

mher

1 known vulnerabilities.

Products

flower 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.9
    CVE-2022-51020

    Flower before 2.2.0 CSRF via Worker and Task Control API Endpoints

    Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrf_cookies is disabled and the OAuth session cookie lacks SameSite. Attackers can lure authenticated users to malicious pages that POST to /api/worker/shutdown, /api/wor…

    mher flower