The vulnerability in provectus kafka-ui (versions 0.7.0 to 0.7.2) resides in the validateAccess function of the /api/smartfilters/testexecutions endpoint. This flaw allows remote attackers to perform code injection by manipulating input to this function. The vulnerability is remotely exploitable without authentication or user interaction, with low complexity and low impact on confidentiality, integrity, and availability. Despite public disclosure and availability of exploit code, the vendor has not provided a patch or remediation guidance.

Successful exploitation could allow an attacker to execute arbitrary code remotely on the affected system running provectus kafka-ui up to version 0.7.2. This could lead to unauthorized actions depending on the privileges of the application process. The CVSS score of 6.9 indicates a medium severity impact with partial impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported so far.

No official patch or remediation is currently available from the vendor, and the vendor has not responded to disclosure attempts. Users should consider mitigating exposure by restricting access to the vulnerable endpoint, applying network-level controls to limit remote access, or discontinuing use of affected versions until a fix is released. Monitor vendor channels for any future updates or patches.