low3.5
CVE-2023-35814
DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms.
Impact
DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Devexpress | Devexpress | before 21.2.12 Versions 22.1.8, 22.2.4, 22.2.5 |
Weakness classification
References
- NVD record
- CVE.org record
- https://code-white.com/public-vulnerability-list/
- https://supportcenter.devexpress.com/ticket/details/t1141158/missing-protection-of-xtrareport-serialized-data-in-asp-net-web-forms
- https://supportcenter.devexpress.com/ticket/details/t1158413/the-allowpassingdatasourceconnectionparameterstoclient-method-may-allow-untrusted-access
- https://supportcenter.devexpress.com/ticket/details/t1160535/web-reporting-well-formed-request-to-a-report-control-s-backend-can-use
- https://supportcenter.devexpress.com/ticket/details/t394936/devexpress-security-advisory-updated-on-april-27-2023