CVE-2023-52251

An issue discovered in provectus kafka-ui 0.4.0 through 0.7.1 allows remote attackers to execute arbitrary code via the q parameter of /api/clusters/local/topics/{topic}/messages.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

85.02% chance of exploitation in the next 30 days, 100th percentile

Nuclei

high · CWE-94

Published

2024-01-25

Updated

2025-06-17

Proof-of-concept exploits (1)

• BobTheShoplifter/CVE-2023-52251-POC20★ · 2024-01-23

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-52251.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/kafka_ui_unauth_rce_c…

References

• CVE Record
• NVD entry

Related

• CVE-2021-45046
• CVE-2022-22965
• CVE-2023-52235
• CVE-2023-52252
• CVE-2023-5223
• CVE-2023-52257