Data quality issue with CVE-2023-52251 (empty package/summary; affected range also incomplete)

**The CVE ID**

CVE-2023-52251 — https://osv.dev/vulnerability/CVE-2023-52251
(API: https://api.osv.dev/v1/vulns/CVE-2023-52251)

This is a CVE record, not a GHSA record.

**Describe the data quality issue observed**

The record resolves, but it carries no usable data:

- `summary` is empty
- the `affected` block has no `package`, so no consumer can match it

The upstream cause is the MITRE CVE record, which was published with `vendor: n/a`,
`product: n/a` and `version: n/a`. I have filed a CVE update request with MITRE to populate
those fields. This report is to flag the OSV side and to put the correct data on record in
the meantime.

There is a second, independent problem: **the affected version range published by NVD is
incomplete.** NVD's description says "provectus kafka-ui 0.4.0 through 0.7.1". Version
0.7.2 is affected as well.

Evidence for that, measured 2026-09-08:

- The vulnerable code is in
`kafka-ui-api/src/main/java/com/provectus/kafka/ui/emitter/MessageFilters.java`. In both
`v0.7.1` and `v0.7.2` that file is 98 lines and identical, importing
`org.codehaus.groovy.jsr223.GroovyScriptEngineImpl` and dispatching
`case GROOVY_SCRIPT: return groovyScriptFilter(query);`. No mitigation was added between
the two tags.
- `v0.7.2` was released 2024-04-10, two and a half months *after* this CVE was published.
- The Docker tags `provectuslabs/kafka-ui:latest` and `provectuslabs/kafka-ui:v0.7.2`
resolve to the same image digest,
`sha256:8f2ff02d64b0a7a2b71b6b3b3148b85f66d00ec20ad40c30bdcd415d46d31818`.

So the default tag people pull today is vulnerable, while the published range tells them
0.7.2 is out of scope.

**Suggested changes to record**

- `summary`: Remote code execution in provectus/kafka-ui via Groovy evaluation in the
message "smart filter", reachable through the `q` parameter of
`/api/clusters/local/topics/{topic}/messages`.
- Affected product: `provectus/kafka-ui`, distributed as the Docker image
`provectuslabs/kafka-ui`.
- Affected versions: **`>= 0.4.0`, `<= 0.7.2`**.
- Fixed version: **none for this product.** The fix exists only in the community fork
`kafbat/kafka-ui`, which replaced Groovy with CEL in commit
https://github.com/kafbat/kafka-ui/commit/11a57d14 (2024-02-10), first released in
v1.0.0 (2024-03-21). That fork changed its Java package namespace from
`com.provectus.kafka.ui` to `io.kafbat.ui`, so remediation is a migration to a different
artifact, not a version upgrade.

I appreciate that OSV has no Docker/OCI ecosystem, so a package-scoped `affected` entry may
not be expressible today. Even a correct `summary` plus the corrected version range in the
record would be an improvement over the current empty entry.

**Additional context**

CVSS 3.1 from NVD is 8.8 HIGH. A public exploit exists:
https://github.com/BobTheShoplifter/CVE-2023-52251-POC

Why this particular record seems worth fixing: the affected image has **447,220,745 pulls**
on Docker Hub with status `active`, the upstream repository (12,278 stars, 1,411 forks) is
**not archived** and has had no commit since 2024-04-08, and its `SECURITY.md` still states
that 0.7.x is "currently being supported with security updates".

Meanwhile no database produces a matchable entry: the GitHub Advisory Database has no entry
for this CVE at all (checked `reviewed`, `unreviewed` and `malware` — zero hits), NVD
derives only `cpe:2.3:a:provectus:ui:*:*:*:*:*:kafka:*:*` with no version boundaries, and
this OSV entry has the empty package field described above. The practical result is that no
scanner reports this issue against the affected image.

This is not theoretical. An operator running `provectuslabs/kafka-ui:latest` at the digest
above, exposed without authentication, had the container used to run a cryptocurrency miner
for roughly 1.5 days, which resulted in an abuse report from their hosting provider. That
compromise happened on the exact version the published range does not list as affected.

References:
- Affected source at v0.7.2: https://github.com/provectus/kafka-ui/blob/v0.7.2/kafka-ui-api/src/main/java/com/provectus/kafka/ui/emitter/MessageFilters.java
- Fix in the fork: https://github.com/kafbat/kafka-ui/commit/11a57d14
- Writeup: http://packetstormsecurity.com/files/177214/Kafka-UI-0.7.1-Command-Injection.html

Start with the CVE-2023-52251 record at the OSV API and compare its current fields with the evidence and suggested values in this issue. Identify the repository's data-update path for CVE records, then verify that the saved record has a usable summary and includes provectus/kafka-ui through version 0.7.2, or document the Docker ecosystem limitation if the schema cannot express it.

Written by the indexing model from the issue text.