Read the docs
TI-2022-11328 Aliases CVE-2022-28684GHSA-cqm5-3ccf-cf57

Deserialization of untrusted data in DevExpress

Priority MEDIUM 45CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-502.

Summary

This vulnerability allows remote attackers to execute arbitrary code on affected installations of DevExpress. Authentication is required to exploit this vulnerability. The specific flaw exists within the SafeBinaryFormatter library. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-16710.

Why it matters now

EPSS 0.03754 89th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
DevExpressDevExpress20.21.01.102—No fix listedCNA
  • DevExpress VendorDevExpress Affected 20.21.01.102 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*18.1.0 to before 18.1.18; 18.2.0 to before 18.2.17; 19.1.0 to before 19.1.15; 19.2.0 to before 19.2.14; 20.1.0 to before 20.1.15; 20.2.0 to before 20.2.11; 21.1.0 to before 21.1.9; 21.2.0 to before 21.2.7VulnerableDevExpress
cpe:2.3:a:devexpress:devexpress:22.1.0:*:*:*:*:*:*:*22.1.0VulnerableDevExpress
  • cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:* Versions 18.1.0 to before 18.1.18; 18.2.0 to before 18.2.17; 19.1.0 to before 19.1.15; 19.2.0 to before 19.2.14; 20.1.0 to before 20.1.15; 20.2.0 to before 20.2.11; 21.1.0 to before 21.1.9; 21.2.0 to before 21.2.7 Vulnerable ·DevExpress
  • cpe:2.3:a:devexpress:devexpress:22.1.0:*:*:*:*:*:*:* Versions 22.1.0 Vulnerable ·DevExpress

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-28684
  2. 2026-10-03 Alias added: GHSA-cqm5-3ccf-cf57

References

Advisory 1

  • TI-2023-17901 DevExpress before 23.1.3 allows AsyncDownloader SSRF. CVSS 3.1CRITICAL 9.8
  • TI-2023-17899 DevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on XML data. CVSS 3.1CRITICAL 9.8
  • TI-2023-17898 DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms. CVSS 3.1CRITICAL 9.8
  • TI-2021-14777 DevExpress.XtraReports.UI through v21.1 allows attackers to execute arbitrary code via insecure deserialization. CVSS 3.1HIGH 8.8
  • TI-2023-17900 DevExpress before 23.1.3 allows arbitrary TypeConverter conversion. CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences