Read the docs
TI-2023-17899 Aliases CVE-2023-35815GHSA-h4mr-59x2-64f9

DevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on XML data.

Priority MEDIUM 43CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-502.

Summary

DevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on XML data.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00616 49th percentileScored 2026-11-07
Fix Fixed DevExpress (DevExpress): 21.2.12, 22.1.7, 22.1.9 +3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DevExpressDevExpressbefore 21.2.12; 22 to before 22.1.7; 22.1.8 to before 22.1.9; 22.2 to before 22.2.3; 22.2.4 to before 22.2.6; 23 to before 23.1.321.2.12, 22.1.7, 22.1.9, 22.2.3, 22.2.6, 23.1.3Patch availableCNA
  • DevExpress VendorDevExpress Affected before 21.2.12; 22 to before 22.1.7; 22.1.8 to before 22.1.9; 22.2 to before 22.2.3; 22.2.4 to before 22.2.6; 23 to before 23.1.3 Fixed in 21.2.12, 22.1.7, 22.1.9, 22.2.3, 22.2.6, 23.1.3 Patch available CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*before 21.2.12VulnerableDevExpress
cpe:2.3:a:devexpress:devexpress:22.1.8:*:*:*:*:*:*:*22.1.8VulnerableDevExpress
cpe:2.3:a:devexpress:devexpress:22.2.4:*:*:*:*:*:*:*22.2.4VulnerableDevExpress
cpe:2.3:a:devexpress:devexpress:22.2.5:*:*:*:*:*:*:*22.2.5VulnerableDevExpress
  • cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:* Versions before 21.2.12 Vulnerable ·DevExpress
  • cpe:2.3:a:devexpress:devexpress:22.1.8:*:*:*:*:*:*:* Versions 22.1.8 Vulnerable ·DevExpress
  • cpe:2.3:a:devexpress:devexpress:22.2.4:*:*:*:*:*:*:* Versions 22.2.4 Vulnerable ·DevExpress
  • cpe:2.3:a:devexpress:devexpress:22.2.5:*:*:*:*:*:*:* Versions 22.2.5 Vulnerable ·DevExpress

Remediation

  • Fix · CNA DevExpress (DevExpress) Fixed in 21.2.12, 22.1.7, 22.1.9, 22.2.3, 22.2.6, 23.1.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    DevExpress 21.2.12, 22.1.7 and 4 more versions

    4 records Highest priority Priority MEDIUM 3 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2023-17901 DevExpress before 23.1.3 allows AsyncDownloader SSRF.Priority MEDIUM 43
    • TI-2023-17898 DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms.Priority MEDIUM 43
    • TI-2023-17900 DevExpress before 23.1.3 allows arbitrary TypeConverter conversion.Priority LOW 25
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-35815
  2. 2026-10-03 Alias added: GHSA-h4mr-59x2-64f9

References

Advisory 1

Other 3

  • TI-2022-11328 Deserialization of untrusted data in DevExpress CVSS 3.1HIGH 8.8
  • TI-2023-17901 DevExpress before 23.1.3 allows AsyncDownloader SSRF. CVSS 3.1CRITICAL 9.8
  • TI-2023-17898 DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms. CVSS 3.1CRITICAL 9.8
  • TI-2021-14777 DevExpress.XtraReports.UI through v21.1 allows attackers to execute arbitrary code via insecure deserialization. CVSS 3.1HIGH 8.8
  • TI-2023-17900 DevExpress before 23.1.3 allows arbitrary TypeConverter conversion. CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences