CVE-2022-51020

Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrfcookies is disabled and the OAuth session cookie lacks SameSite. Attackers can lure authenticated users to malicious pages that POST to /api/worker/shutdown, /api/worker/pool/restart, or /api/task/revoke t...

CVE-2022-51020 Flower before 2.2.0 CSRF via Worker and Task Control API Endpoints

Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrfcookies is disabled and the OAuth session cookie lacks SameSite. Attackers can lure authenticated users to malicious pages that POST to /api/worker/shutdown, /api/worker/pool/restart, or /api/task/revoke t...

PT-2026-110919

Name of the Vulnerable Software and Affected Versions Flower versions prior to 2.2.0 Description Cross-site request forgery occurs because Tornado xsrf cookies are disabled and the OAuth session cookie lacks the SameSite attribute. This allows attackers to trick authenticated users into visiting...

CVE-2022-51020: Cross-Site Request Forgery (CSRF)

Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrfcookies is disabled and the OAuth session cookie lacks SameSite. Attackers can lure authenticated users to malicious pages that POST to /api/worker/shutdown, /api/worker/pool/restart, or /api/task/revoke t...