VULNERABILITY INTELLIGENCE

CVE-2019-16925

CVSS score6.1 MEDIUM
EPSS probability0.82%
CISA KEVNot currently listed
Published2019-09-28
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

Flower 0.9.3 has XSS via the name parameter in an @app.task call. NOTE: The project author stated that he doesn't think this is a valid vulnerability. Worker name and task name aren’t user facing configuration options. They are internal backend config options and person having rights to change them already has full access

Weakness classification

  • nvd@nist.gov: CWE-79

Primary references