CVE-2023-46134
CVSS 3.1 Score 9.8 of 10 (high)
Details
Summary
CVE-2023-46134 is a remote code execution vulnerability affecting the D-Tale data analysis tool before version 3.7.0. The combination of Flask back-end and React front-end is used to view and analyze Pandas data structures. This vulnerability arises due to the lack of proper input validation on the "Custom Filter" feature, allowing unauthenticated attackers to execute malicious code on the server. The vulnerability has been mitigated by default disabling the "Custom Filter" input in version 3.7.0. For older versions, the only workaround is to restrict access to D-Tale to trusted users.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Vendors
- Man Truck & Bus SE
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions