CVE-2023-35814
LOWDevExpress < 23.1.3 - Deserialization of Untrusted Data in XtraReport
Title source: llmDescription
DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms.
References (5)
Core 5
Core References
Vendor Advisory
https://code-white.com/public-vulnerability-list/
Permissions Required
https://supportcenter.devexpress.com/ticket/details/t1141158/missing-protection-of-xtrareport-serialized-data-in-asp-net-web-forms
Permissions Required
https://supportcenter.devexpress.com/ticket/details/t1158413/the-allowpassingdatasourceconnectionparameterstoclient-method-may-allow-untrusted-access
Scores
CVSS v3
3.5
EPSS
0.0039
EPSS Percentile
30.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-502
Status
published
Products (4)
devexpress/devexpress
22.1.8
devexpress/devexpress
22.2.4
devexpress/devexpress
22.2.5
devexpress/devexpress
< 21.2.12
Published
Apr 28, 2025
Tracked Since
Feb 18, 2026