Provectus
Monthly
Remote code injection in provectus kafka-ui up to version 0.7.2 allows a low-privileged authenticated attacker to execute arbitrary Groovy code on the server via the smart filter test endpoint. The vulnerability resides in the executeSmartFilterTest function of MessagesController.java, where user-supplied Groovy expressions are evaluated without adequate sandboxing or restriction. A publicly available proof-of-concept exploit exists, no vendor patch has been released, and the project maintainers have not responded to the responsible disclosure report.
Code injection in Provectus kafka-ui up to version 0.7.2 allows unauthenticated remote attackers to execute arbitrary code via the validateAccess function in the /api/smartfilters/testexecutions endpoint. The vulnerability has publicly available exploit code and carries a CVSS 6.9 score reflecting moderate but meaningful real-world risk; the vendor was contacted early but provided no response, suggesting no patch is anticipated.
Remote code injection in provectus kafka-ui up to version 0.7.2 allows a low-privileged authenticated attacker to execute arbitrary Groovy code on the server via the smart filter test endpoint. The vulnerability resides in the executeSmartFilterTest function of MessagesController.java, where user-supplied Groovy expressions are evaluated without adequate sandboxing or restriction. A publicly available proof-of-concept exploit exists, no vendor patch has been released, and the project maintainers have not responded to the responsible disclosure report.
Code injection in Provectus kafka-ui up to version 0.7.2 allows unauthenticated remote attackers to execute arbitrary code via the validateAccess function in the /api/smartfilters/testexecutions endpoint. The vulnerability has publicly available exploit code and carries a CVSS 6.9 score reflecting moderate but meaningful real-world risk; the vendor was contacted early but provided no response, suggesting no patch is anticipated.