CVE-2023-46134

CVSS 3.1 Score 9.8 of 10 (high)

Details

Published Oct 25, 2023
Updated: Nov 6, 2023
CWE ID 79

Summary

CVE-2023-46134 is a remote code execution vulnerability affecting the D-Tale data analysis tool before version 3.7.0. The combination of Flask back-end and React front-end is used to view and analyze Pandas data structures. This vulnerability arises due to the lack of proper input validation on the "Custom Filter" feature, allowing unauthenticated attackers to execute malicious code on the server. The vulnerability has been mitigated by default disabling the "Custom Filter" input in version 3.7.0. For older versions, the only workaround is to restrict access to D-Tale to trusted users.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share