CVE-2023-46134

Summary

CVE-2023-46134 is a remote code execution vulnerability affecting the D-Tale data analysis tool before version 3.7.0. The combination of Flask back-end and React front-end is used to view and analyze Pandas data structures. This vulnerability arises due to the lack of proper input validation on the "Custom Filter" feature, allowing unauthenticated attackers to execute malicious code on the server. The vulnerability has been mitigated by default disabling the "Custom Filter" input in version 3.7.0. For older versions, the only workaround is to restrict access to D-Tale to trusted users.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.