Lucene search

GitHub_MVULNRICHMENT:CVE-2023-46134

HistoryOct 25, 2023 - 8:51 p.m.

CVE-2023-46134 D-Tale vulnerable to Remote Code Execution through the Custom Filter Input

2023-10-2520:51:40

CWE-79

GitHub_M

github.com

cve-2023-46134

d-tale

remote code execution

patched

vulnerability

server security

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

7.5

Confidence

Low

EPSS

0.003

Percentile

70.9%

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

D-Tale is the combination of a Flask back-end and a React front-end to view & analyze Pandas data structures. Prior to version 3.7.0, users hosting D-Tale publicly can be vulnerable to remote code execution, allowing attackers to run malicious code on the server. This issue has been patched in version 3.7.0 by turning off “Custom Filter” input by default. The only workaround for versions earlier than 3.7.0 is to only host D-Tale to trusted users.

References

github.com/man-group/dtale/commit/bf8c54ab2490803f45f0652a9a0e221a94d39668

github.com/man-group/dtale/security/advisories/GHSA-jq6c-r9xf-qxjm

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

7.5

Confidence

Low

EPSS

0.003

Percentile

70.9%

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Related for VULNRICHMENT:CVE-2023-46134