Vulnerabilites related to DevExpress - DevExpress
Vulnerability from fkie_nvd
Published
2025-04-28 16:15
Modified
2025-06-05 14:30
Severity ?
3.5 (Low) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Summary
DevExpress before 23.1.3 allows arbitrary TypeConverter conversion.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| devexpress | devexpress | * | |
| devexpress | devexpress | 22.1.8 | |
| devexpress | devexpress | 22.2.4 | |
| devexpress | devexpress | 22.2.5 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A8A17F8A-D0F9-44E3-9B01-B45C891A0BAC",
"versionEndExcluding": "21.2.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:devexpress:devexpress:22.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "2727DAD4-78F4-459D-A92A-A33D11021FEC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:devexpress:devexpress:22.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "F5FA2CF5-4136-460C-841E-E38330CD4F33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:devexpress:devexpress:22.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B81D56FB-7444-4436-9431-94D3DD48300E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "DevExpress before 23.1.3 allows arbitrary TypeConverter conversion."
},
{
"lang": "es",
"value": "DevExpress anterior a 23.1.3 permite la conversi\u00f3n arbitraria de TypeConverter."
}
],
"id": "CVE-2023-35816",
"lastModified": "2025-06-05T14:30:08.290",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 1.4,
"source": "cve@mitre.org",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2025-04-28T16:15:26.300",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://code-white.com/public-vulnerability-list/"
},
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://supportcenter.devexpress.com/ticket/details/t1127422/insecure-arbitrary-typeconverter-conversion"
},
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://supportcenter.devexpress.com/ticket/details/t1159641/net-desktop-and-web-controls-unsafe-data-type-deserialization"
},
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://supportcenter.devexpress.com/ticket/details/t394936/devexpress-security-advisory-updated-on-april-27-2023"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-23"
}
],
"source": "cve@mitre.org",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-704"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2025-04-28 16:15
Modified
2025-06-05 14:29
Severity ?
3.5 (Low) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
DevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on XML data.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| devexpress | devexpress | * | |
| devexpress | devexpress | 22.1.8 | |
| devexpress | devexpress | 22.2.4 | |
| devexpress | devexpress | 22.2.5 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A8A17F8A-D0F9-44E3-9B01-B45C891A0BAC",
"versionEndExcluding": "21.2.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:devexpress:devexpress:22.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "2727DAD4-78F4-459D-A92A-A33D11021FEC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:devexpress:devexpress:22.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "F5FA2CF5-4136-460C-841E-E38330CD4F33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:devexpress:devexpress:22.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B81D56FB-7444-4436-9431-94D3DD48300E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "DevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on XML data."
},
{
"lang": "es",
"value": "DevExpress anterior a 23.1.3 tiene un mecanismo de protecci\u00f3n de fuente de datos que se evita durante la deserializaci\u00f3n de datos XML."
}
],
"id": "CVE-2023-35815",
"lastModified": "2025-06-05T14:29:53.303",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 1.4,
"source": "cve@mitre.org",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2025-04-28T16:15:25.903",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://code-white.com/public-vulnerability-list/"
},
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://supportcenter.devexpress.com/ticket/details/t1141947/data-source-protection-bypass-during-xml-deserialization"
},
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://supportcenter.devexpress.com/ticket/details/t1159142/web-reporting-data-source-protection-bypassed-during-xml-deserialization"
},
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://supportcenter.devexpress.com/ticket/details/t394936/devexpress-security-advisory-updated-on-april-27-2023"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-502"
}
],
"source": "cve@mitre.org",
"type": "Secondary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-08-04 11:15
Modified
2024-11-21 06:13
Severity ?
Summary
DevExpress.XtraReports.UI through v21.1 allows attackers to execute arbitrary code via insecure deserialization.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| devexpress | devexpress | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
"matchCriteriaId": "450CA3B2-D9B7-4578-AF12-E9ACAC534C62",
"versionEndIncluding": "21.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "DevExpress.XtraReports.UI through v21.1 allows attackers to execute arbitrary code via insecure deserialization."
},
{
"lang": "es",
"value": "DevExpress.XtraReports.UI versiones hasta v21.1, permite a atacantes ejecutar c\u00f3digo arbitrario por medio de una deserializaci\u00f3n no segura"
}
],
"id": "CVE-2021-36483",
"lastModified": "2024-11-21T06:13:45.430",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-08-04T11:15:08.040",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://gist.github.com/tree-chtsec/27013ed6cb297b24e44f6359439b678e"
},
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required",
"Vendor Advisory"
],
"url": "https://supportcenter.devexpress.com/ticket/details/t1031535/reporting-unsafe-data-type-deserialization"
},
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required",
"Vendor Advisory"
],
"url": "https://supportcenter.devexpress.com/ticket/details/t708194/net-web-controls-unsafe-data-type-deserialization"
},
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required",
"Vendor Advisory"
],
"url": "https://supportcenter.devexpress.com/ticket/details/t714296/net-desktop-controls-unsafe-data-type-deserialization"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.chtsecurity.com/news/a01d1bc6-19c8-4187-b343-6bc685efe64f"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-22-341/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://gist.github.com/tree-chtsec/27013ed6cb297b24e44f6359439b678e"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Permissions Required",
"Vendor Advisory"
],
"url": "https://supportcenter.devexpress.com/ticket/details/t1031535/reporting-unsafe-data-type-deserialization"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Permissions Required",
"Vendor Advisory"
],
"url": "https://supportcenter.devexpress.com/ticket/details/t708194/net-web-controls-unsafe-data-type-deserialization"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Permissions Required",
"Vendor Advisory"
],
"url": "https://supportcenter.devexpress.com/ticket/details/t714296/net-desktop-controls-unsafe-data-type-deserialization"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.chtsecurity.com/news/a01d1bc6-19c8-4187-b343-6bc685efe64f"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-22-341/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-502"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2025-04-28 16:15
Modified
2025-06-05 14:29
Severity ?
3.5 (Low) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| devexpress | devexpress | * | |
| devexpress | devexpress | 22.1.8 | |
| devexpress | devexpress | 22.2.4 | |
| devexpress | devexpress | 22.2.5 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A8A17F8A-D0F9-44E3-9B01-B45C891A0BAC",
"versionEndExcluding": "21.2.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:devexpress:devexpress:22.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "2727DAD4-78F4-459D-A92A-A33D11021FEC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:devexpress:devexpress:22.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "F5FA2CF5-4136-460C-841E-E38330CD4F33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:devexpress:devexpress:22.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B81D56FB-7444-4436-9431-94D3DD48300E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms."
},
{
"lang": "es",
"value": "DevExpress anterior a 23.1.3 no protege adecuadamente los datos serializados de XtraReport en formularios web ASP.NET."
}
],
"id": "CVE-2023-35814",
"lastModified": "2025-06-05T14:29:42.040",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 1.4,
"source": "cve@mitre.org",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2025-04-28T16:15:25.357",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://code-white.com/public-vulnerability-list/"
},
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://supportcenter.devexpress.com/ticket/details/t1141158/missing-protection-of-xtrareport-serialized-data-in-asp-net-web-forms"
},
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://supportcenter.devexpress.com/ticket/details/t1158413/the-allowpassingdatasourceconnectionparameterstoclient-method-may-allow-untrusted-access"
},
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://supportcenter.devexpress.com/ticket/details/t1160535/web-reporting-well-formed-request-to-a-report-control-s-backend-can-use"
},
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://supportcenter.devexpress.com/ticket/details/t394936/devexpress-security-advisory-updated-on-april-27-2023"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-502"
}
],
"source": "cve@mitre.org",
"type": "Secondary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-08-03 16:15
Modified
2024-11-21 06:57
Severity ?
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of DevExpress. Authentication is required to exploit this vulnerability. The specific flaw exists within the SafeBinaryFormatter library. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-16710.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| zdi-disclosures@trendmicro.com | https://www.zerodayinitiative.com/advisories/ZDI-22-872/ | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.zerodayinitiative.com/advisories/ZDI-22-872/ | Third Party Advisory, VDB Entry |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| devexpress | devexpress | * | |
| devexpress | devexpress | * | |
| devexpress | devexpress | * | |
| devexpress | devexpress | * | |
| devexpress | devexpress | * | |
| devexpress | devexpress | * | |
| devexpress | devexpress | * | |
| devexpress | devexpress | * | |
| devexpress | devexpress | 22.1.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A127F1DA-A376-4F1C-B096-AFFD6027337E",
"versionEndExcluding": "18.1.18",
"versionStartIncluding": "18.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1AFE78F3-CCE4-4DD8-BA97-A83106D5846E",
"versionEndExcluding": "18.2.17",
"versionStartIncluding": "18.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
"matchCriteriaId": "609BB707-4650-4760-BF9B-8DD7F303DFA0",
"versionEndExcluding": "19.1.15",
"versionStartIncluding": "19.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
"matchCriteriaId": "948A442E-BC00-4D00-A6BA-1A11C796E60A",
"versionEndExcluding": "19.2.14",
"versionStartIncluding": "19.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BE7065ED-9046-46DC-8B5E-625A6849E7C0",
"versionEndExcluding": "20.1.15",
"versionStartIncluding": "20.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DED82673-3289-44D1-A3D0-E1E2C3FB76D8",
"versionEndExcluding": "20.2.11",
"versionStartIncluding": "20.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
"matchCriteriaId": "48A88268-3BC6-4178-9AC1-481C38810334",
"versionEndExcluding": "21.1.9",
"versionStartIncluding": "21.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C30FBCCA-4346-4411-949B-576DA4842C49",
"versionEndExcluding": "21.2.7",
"versionStartIncluding": "21.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:devexpress:devexpress:22.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A40A0836-5257-4DD9-8BB6-D2627DFD014B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of DevExpress. Authentication is required to exploit this vulnerability. The specific flaw exists within the SafeBinaryFormatter library. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-16710."
},
{
"lang": "es",
"value": "Esta vulnerabilidad permite a atacantes remotos ejecutar c\u00f3digo arbitrario en las instalaciones afectadas de DevExpress. Es requerida autenticaci\u00f3n para explotar esta vulnerabilidad. El fallo espec\u00edfico se presenta en la biblioteca SafeBinaryFormatter. El problema es debido a que no son comprobados apropiadamente los datos suministrados por el usuario, lo que puede resultar en una deserializaci\u00f3n de datos no confiables. Un atacante puede aprovechar esta vulnerabilidad para ejecutar c\u00f3digo en el contexto de la cuenta de servicio. Era ZDI-CAN-16710"
}
],
"id": "CVE-2022-28684",
"lastModified": "2024-11-21T06:57:44.340",
"metrics": {
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "zdi-disclosures@trendmicro.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-08-03T16:15:08.307",
"references": [
{
"source": "zdi-disclosures@trendmicro.com",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-22-872/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-22-872/"
}
],
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-502"
}
],
"source": "zdi-disclosures@trendmicro.com",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2025-04-28 16:15
Modified
2025-06-05 14:30
Severity ?
5.0 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
DevExpress before 23.1.3 allows AsyncDownloader SSRF.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| devexpress | devexpress | * | |
| devexpress | devexpress | 22.1.8 | |
| devexpress | devexpress | 22.2.4 | |
| devexpress | devexpress | 22.2.5 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A8A17F8A-D0F9-44E3-9B01-B45C891A0BAC",
"versionEndExcluding": "21.2.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:devexpress:devexpress:22.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "2727DAD4-78F4-459D-A92A-A33D11021FEC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:devexpress:devexpress:22.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "F5FA2CF5-4136-460C-841E-E38330CD4F33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:devexpress:devexpress:22.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B81D56FB-7444-4436-9431-94D3DD48300E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "DevExpress before 23.1.3 allows AsyncDownloader SSRF."
},
{
"lang": "es",
"value": "DevExpress anterior a 23.1.3 permite AsyncDownloader SSRF."
}
],
"id": "CVE-2023-35817",
"lastModified": "2025-06-05T14:30:31.390",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.1,
"impactScore": 1.4,
"source": "cve@mitre.org",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2025-04-28T16:15:26.753",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://code-white.com/public-vulnerability-list/"
},
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://supportcenter.devexpress.com/ticket/details/t1157209/server-side-request-forgery-via-asyncdownloader"
},
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://supportcenter.devexpress.com/ticket/details/t1161404/report-and-dashboard-server-improper-default-configuration-can-lead-to-ssrf-attacks"
},
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://supportcenter.devexpress.com/ticket/details/t1162045/reporting-bi-dashboard-office-file-api-web-app-configuration-to-help-prevent-ssrf-attacks"
},
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://supportcenter.devexpress.com/ticket/details/t394936/devexpress-security-advisory-updated-on-april-27-2023"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-918"
}
],
"source": "cve@mitre.org",
"type": "Secondary"
}
]
}
CVE-2023-35814 (GCVE-0-2023-35814)
Vulnerability from cvelistv5
Published
2025-04-28 00:00
Modified
2025-04-28 15:56
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-502 - Deserialization of Untrusted Data
Summary
DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| DevExpress | DevExpress |
Version: 0 < 21.2.12 Version: 22 < 22.1.7 Version: 22.1.8 < 22.1.9 Version: 22.2 < 22.2.3 Version: 22.2.4 < 22.2.6 Version: 23 < 23.1.3 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-35814",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-28T15:55:54.213286Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-28T15:56:00.337Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "DevExpress",
"vendor": "DevExpress",
"versions": [
{
"lessThan": "21.2.12",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "22.1.7",
"status": "affected",
"version": "22",
"versionType": "custom"
},
{
"lessThan": "22.1.9",
"status": "affected",
"version": "22.1.8",
"versionType": "custom"
},
{
"lessThan": "22.2.3",
"status": "affected",
"version": "22.2",
"versionType": "custom"
},
{
"lessThan": "22.2.6",
"status": "affected",
"version": "22.2.4",
"versionType": "custom"
},
{
"lessThan": "23.1.3",
"status": "affected",
"version": "23",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
"versionEndExcluding": "21.2.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
"versionEndExcluding": "22.1.7",
"versionStartIncluding": "22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
"versionEndExcluding": "22.1.9",
"versionStartIncluding": "22.1.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
"versionEndExcluding": "22.2.3",
"versionStartIncluding": "22.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
"versionEndExcluding": "22.2.6",
"versionStartIncluding": "22.2.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
"versionEndExcluding": "23.1.3",
"versionStartIncluding": "23",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-28T15:54:16.095Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://supportcenter.devexpress.com/ticket/details/t394936/devexpress-security-advisory-updated-on-april-27-2023"
},
{
"url": "https://code-white.com/public-vulnerability-list/"
},
{
"url": "https://supportcenter.devexpress.com/ticket/details/t1141158/missing-protection-of-xtrareport-serialized-data-in-asp-net-web-forms"
},
{
"url": "https://supportcenter.devexpress.com/ticket/details/t1160535/web-reporting-well-formed-request-to-a-report-control-s-backend-can-use"
},
{
"url": "https://supportcenter.devexpress.com/ticket/details/t1158413/the-allowpassingdatasourceconnectionparameterstoclient-method-may-allow-untrusted-access"
}
],
"x_generator": {
"engine": "enrichogram 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-35814",
"datePublished": "2025-04-28T00:00:00.000Z",
"dateReserved": "2023-06-17T00:00:00.000Z",
"dateUpdated": "2025-04-28T15:56:00.337Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-35817 (GCVE-0-2023-35817)
Vulnerability from cvelistv5
Published
2025-04-28 00:00
Modified
2025-04-28 18:03
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Summary
DevExpress before 23.1.3 allows AsyncDownloader SSRF.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| DevExpress | DevExpress |
Version: 0 < 21.2.12 Patch: 22 Version: 22.1.8 < 22.1.9 Version: 22.2 < 22.2.3 Version: 22.2.4 < 22.2.6 Version: 23 < 23.1.3 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-35817",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-28T18:02:56.672870Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-28T18:03:18.175Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "DevExpress",
"vendor": "DevExpress",
"versions": [
{
"lessThan": "21.2.12",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "22.1.7",
"status": "unaffected",
"version": "22",
"versionType": "custom"
},
{
"lessThan": "22.1.9",
"status": "affected",
"version": "22.1.8",
"versionType": "custom"
},
{
"lessThan": "22.2.3",
"status": "affected",
"version": "22.2",
"versionType": "custom"
},
{
"lessThan": "22.2.6",
"status": "affected",
"version": "22.2.4",
"versionType": "custom"
},
{
"lessThan": "23.1.3",
"status": "affected",
"version": "23",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "DevExpress before 23.1.3 allows AsyncDownloader SSRF."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-28T16:12:35.996Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://supportcenter.devexpress.com/ticket/details/t394936/devexpress-security-advisory-updated-on-april-27-2023"
},
{
"url": "https://supportcenter.devexpress.com/ticket/details/t1161404/report-and-dashboard-server-improper-default-configuration-can-lead-to-ssrf-attacks"
},
{
"url": "https://supportcenter.devexpress.com/ticket/details/t1162045/reporting-bi-dashboard-office-file-api-web-app-configuration-to-help-prevent-ssrf-attacks"
},
{
"url": "https://code-white.com/public-vulnerability-list/"
},
{
"url": "https://supportcenter.devexpress.com/ticket/details/t1157209/server-side-request-forgery-via-asyncdownloader"
}
],
"x_generator": {
"engine": "enrichogram 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-35817",
"datePublished": "2025-04-28T00:00:00.000Z",
"dateReserved": "2023-06-17T00:00:00.000Z",
"dateUpdated": "2025-04-28T18:03:18.175Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-36483 (GCVE-0-2021-36483)
Vulnerability from cvelistv5
Published
2021-08-04 10:04
Modified
2024-08-04 00:54
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
DevExpress.XtraReports.UI through v21.1 allows attackers to execute arbitrary code via insecure deserialization.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T00:54:51.443Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://gist.github.com/tree-chtsec/27013ed6cb297b24e44f6359439b678e"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://supportcenter.devexpress.com/ticket/details/t708194/net-web-controls-unsafe-data-type-deserialization"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://supportcenter.devexpress.com/ticket/details/t714296/net-desktop-controls-unsafe-data-type-deserialization"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.chtsecurity.com/news/a01d1bc6-19c8-4187-b343-6bc685efe64f"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://supportcenter.devexpress.com/ticket/details/t1031535/reporting-unsafe-data-type-deserialization"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-22-341/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "DevExpress.XtraReports.UI through v21.1 allows attackers to execute arbitrary code via insecure deserialization."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-02-15T15:06:19",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://gist.github.com/tree-chtsec/27013ed6cb297b24e44f6359439b678e"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://supportcenter.devexpress.com/ticket/details/t708194/net-web-controls-unsafe-data-type-deserialization"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://supportcenter.devexpress.com/ticket/details/t714296/net-desktop-controls-unsafe-data-type-deserialization"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.chtsecurity.com/news/a01d1bc6-19c8-4187-b343-6bc685efe64f"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://supportcenter.devexpress.com/ticket/details/t1031535/reporting-unsafe-data-type-deserialization"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-22-341/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-36483",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "DevExpress.XtraReports.UI through v21.1 allows attackers to execute arbitrary code via insecure deserialization."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://gist.github.com/tree-chtsec/27013ed6cb297b24e44f6359439b678e",
"refsource": "MISC",
"url": "https://gist.github.com/tree-chtsec/27013ed6cb297b24e44f6359439b678e"
},
{
"name": "https://supportcenter.devexpress.com/ticket/details/t708194/net-web-controls-unsafe-data-type-deserialization",
"refsource": "MISC",
"url": "https://supportcenter.devexpress.com/ticket/details/t708194/net-web-controls-unsafe-data-type-deserialization"
},
{
"name": "https://supportcenter.devexpress.com/ticket/details/t714296/net-desktop-controls-unsafe-data-type-deserialization",
"refsource": "MISC",
"url": "https://supportcenter.devexpress.com/ticket/details/t714296/net-desktop-controls-unsafe-data-type-deserialization"
},
{
"name": "https://www.chtsecurity.com/news/a01d1bc6-19c8-4187-b343-6bc685efe64f",
"refsource": "MISC",
"url": "https://www.chtsecurity.com/news/a01d1bc6-19c8-4187-b343-6bc685efe64f"
},
{
"name": "https://supportcenter.devexpress.com/ticket/details/t1031535/reporting-unsafe-data-type-deserialization",
"refsource": "CONFIRM",
"url": "https://supportcenter.devexpress.com/ticket/details/t1031535/reporting-unsafe-data-type-deserialization"
},
{
"name": "https://www.zerodayinitiative.com/advisories/ZDI-22-341/",
"refsource": "MISC",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-22-341/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-36483",
"datePublished": "2021-08-04T10:04:29",
"dateReserved": "2021-07-12T00:00:00",
"dateUpdated": "2024-08-04T00:54:51.443Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-35816 (GCVE-0-2023-35816)
Vulnerability from cvelistv5
Published
2025-04-28 00:00
Modified
2025-04-28 18:08
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-23 - Relative Path Traversal
Summary
DevExpress before 23.1.3 allows arbitrary TypeConverter conversion.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| DevExpress | DevExpress |
Version: 0 < 21.2.12 Version: 22 < 22.1.7 Version: 22.1.8 < 22.1.9 Version: 22.2 < 22.2.3 Version: 22.2.4 < 22.2.6 Version: 23 < 23.1.3 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-35816",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-28T18:08:00.826540Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-28T18:08:07.672Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "DevExpress",
"vendor": "DevExpress",
"versions": [
{
"lessThan": "21.2.12",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "22.1.7",
"status": "affected",
"version": "22",
"versionType": "custom"
},
{
"lessThan": "22.1.9",
"status": "affected",
"version": "22.1.8",
"versionType": "custom"
},
{
"lessThan": "22.2.3",
"status": "affected",
"version": "22.2",
"versionType": "custom"
},
{
"lessThan": "22.2.6",
"status": "affected",
"version": "22.2.4",
"versionType": "custom"
},
{
"lessThan": "23.1.3",
"status": "affected",
"version": "23",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
"versionEndExcluding": "21.2.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
"versionEndExcluding": "22.1.7",
"versionStartIncluding": "22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
"versionEndExcluding": "22.1.9",
"versionStartIncluding": "22.1.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
"versionEndExcluding": "22.2.3",
"versionStartIncluding": "22.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
"versionEndExcluding": "22.2.6",
"versionStartIncluding": "22.2.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
"versionEndExcluding": "23.1.3",
"versionStartIncluding": "23",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "DevExpress before 23.1.3 allows arbitrary TypeConverter conversion."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-23",
"description": "CWE-23 Relative Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-28T16:12:05.415Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://supportcenter.devexpress.com/ticket/details/t394936/devexpress-security-advisory-updated-on-april-27-2023"
},
{
"url": "https://supportcenter.devexpress.com/ticket/details/t1159641/net-desktop-and-web-controls-unsafe-data-type-deserialization"
},
{
"url": "https://code-white.com/public-vulnerability-list/"
},
{
"url": "https://supportcenter.devexpress.com/ticket/details/t1127422/insecure-arbitrary-typeconverter-conversion"
}
],
"x_generator": {
"engine": "enrichogram 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-35816",
"datePublished": "2025-04-28T00:00:00.000Z",
"dateReserved": "2023-06-17T00:00:00.000Z",
"dateUpdated": "2025-04-28T18:08:07.672Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-35815 (GCVE-0-2023-35815)
Vulnerability from cvelistv5
Published
2025-04-28 00:00
Modified
2025-04-28 18:08
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-502 - Deserialization of Untrusted Data
Summary
DevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on XML data.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| DevExpress | DevExpress |
Version: 0 < 21.2.12 Version: 22 < 22.1.7 Version: 22.1.8 < 22.1.9 Version: 22.2 < 22.2.3 Version: 22.2.4 < 22.2.6 Version: 23 < 23.1.3 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-35815",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-28T18:08:24.167602Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-28T18:08:30.889Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "DevExpress",
"vendor": "DevExpress",
"versions": [
{
"lessThan": "21.2.12",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "22.1.7",
"status": "affected",
"version": "22",
"versionType": "custom"
},
{
"lessThan": "22.1.9",
"status": "affected",
"version": "22.1.8",
"versionType": "custom"
},
{
"lessThan": "22.2.3",
"status": "affected",
"version": "22.2",
"versionType": "custom"
},
{
"lessThan": "22.2.6",
"status": "affected",
"version": "22.2.4",
"versionType": "custom"
},
{
"lessThan": "23.1.3",
"status": "affected",
"version": "23",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
"versionEndExcluding": "21.2.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
"versionEndExcluding": "22.1.7",
"versionStartIncluding": "22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
"versionEndExcluding": "22.1.9",
"versionStartIncluding": "22.1.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
"versionEndExcluding": "22.2.3",
"versionStartIncluding": "22.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
"versionEndExcluding": "22.2.6",
"versionStartIncluding": "22.2.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
"versionEndExcluding": "23.1.3",
"versionStartIncluding": "23",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "DevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on XML data."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-28T16:11:40.586Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://supportcenter.devexpress.com/ticket/details/t394936/devexpress-security-advisory-updated-on-april-27-2023"
},
{
"url": "https://supportcenter.devexpress.com/ticket/details/t1159142/web-reporting-data-source-protection-bypassed-during-xml-deserialization"
},
{
"url": "https://code-white.com/public-vulnerability-list/"
},
{
"url": "https://supportcenter.devexpress.com/ticket/details/t1141947/data-source-protection-bypass-during-xml-deserialization"
}
],
"x_generator": {
"engine": "enrichogram 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-35815",
"datePublished": "2025-04-28T00:00:00.000Z",
"dateReserved": "2023-06-17T00:00:00.000Z",
"dateUpdated": "2025-04-28T18:08:30.889Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-28684 (GCVE-0-2022-28684)
Vulnerability from cvelistv5
Published
2022-08-03 15:20
Modified
2024-08-03 06:03
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-502 - Deserialization of Untrusted Data
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of DevExpress. Authentication is required to exploit this vulnerability. The specific flaw exists within the SafeBinaryFormatter library. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-16710.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-22-872/ | x_refsource_MISC |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| DevExpress | DevExpress |
Version: 20.21.01.102 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T06:03:52.478Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-22-872/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "DevExpress",
"vendor": "DevExpress",
"versions": [
{
"status": "affected",
"version": "20.21.01.102"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Markus Wulftange (@mwulftange)"
}
],
"descriptions": [
{
"lang": "en",
"value": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of DevExpress. Authentication is required to exploit this vulnerability. The specific flaw exists within the SafeBinaryFormatter library. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-16710."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502: Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-08-03T15:20:46",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-22-872/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "zdi-disclosures@trendmicro.com",
"ID": "CVE-2022-28684",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "DevExpress",
"version": {
"version_data": [
{
"version_value": "20.21.01.102"
}
]
}
}
]
},
"vendor_name": "DevExpress"
}
]
}
},
"credit": "Markus Wulftange (@mwulftange)",
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of DevExpress. Authentication is required to exploit this vulnerability. The specific flaw exists within the SafeBinaryFormatter library. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-16710."
}
]
},
"impact": {
"cvss": {
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-502: Deserialization of Untrusted Data"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.zerodayinitiative.com/advisories/ZDI-22-872/",
"refsource": "MISC",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-22-872/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2022-28684",
"datePublished": "2022-08-03T15:20:46",
"dateReserved": "2022-04-05T00:00:00",
"dateUpdated": "2024-08-03T06:03:52.478Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}