Security readout for executives and security teams
Plain-English summary
CVE-2019-16925 reports cross-site scripting in Flower 0.9.3 involving task naming. The key business caveat is that the project author disputed it, saying worker and task names are internal backend configuration, not user-facing inputs. No source in the bundle reports active exploitation.
Executive priority
Low immediate escalation unless Flower is exposed broadly or untrusted users can influence backend task configuration. Track as an exposure-hardening item because official severity data and remediation detail are incomplete.
Technical view
The CVE describes XSS via the name parameter in an @app.task call in Flower 0.9.3. The source bundle provides no CVSS, CWE, patch version, or confirmed exploit status. The maintainer note says changing worker or task names already implies backend configuration access.
Likely exposure
Exposure is most plausible where Flower 0.9.3 is used and untrusted or low-privileged parties can influence Celery task names, worker names, or backend task registration. The CVE itself says these values are normally internal configuration, which limits typical exposure.
Exploitation context
CISA KEV status is false in the bundle. The provided sources do not state active exploitation. Any practical impact depends on whether an attacker can control internal task naming and whether a victim views the affected Flower interface.
Researcher notes
The record is sparse and disputed. Do not assume normal web-user exploitability from the CVE text alone. The important research question is whether task or worker names can cross trust boundaries in a specific deployment.
Mitigation direction
- Inventory Flower deployments and confirm whether version 0.9.3 is present.
- Check upstream Flower guidance before applying version-specific remediation.
- Restrict Flower access to trusted administrators and internal networks.
- Review who can modify Celery task registration or worker configuration.
- Treat untrusted control over task names as a security boundary issue.
Validation and detection
- Confirm deployed Flower versions from asset inventory or package metadata.
- Review Celery code for @app.task name values from untrusted sources.
- Verify Flower is not publicly reachable without strong access control.
- Check change control for who can alter worker or task configuration.
- Document whether the disputed maintainer assumptions hold in your environment.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2019-16925 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://fatihhcelik.blogspot.com/2019/09/flower-100-has-xss-via-name-parameter.htmlCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.