Read the docs
TI-2023-17900 Aliases CVE-2023-35816GHSA-22wj-vp2m-rxhc

DevExpress before 23.1.3 allows arbitrary TypeConverter conversion.

Priority LOW 25CWE-23Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

DevExpress before 23.1.3 allows arbitrary TypeConverter conversion.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00557 46th percentileScored 2026-11-07
Fix Fixed DevExpress (DevExpress): 21.2.12, 22.1.7, 22.1.9 +3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DevExpressDevExpressbefore 21.2.12; 22 to before 22.1.7; 22.1.8 to before 22.1.9; 22.2 to before 22.2.3; 22.2.4 to before 22.2.6; 23 to before 23.1.321.2.12, 22.1.7, 22.1.9, 22.2.3, 22.2.6, 23.1.3Patch availableCNA
  • DevExpress VendorDevExpress Affected before 21.2.12; 22 to before 22.1.7; 22.1.8 to before 22.1.9; 22.2 to before 22.2.3; 22.2.4 to before 22.2.6; 23 to before 23.1.3 Fixed in 21.2.12, 22.1.7, 22.1.9, 22.2.3, 22.2.6, 23.1.3 Patch available CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*before 21.2.12VulnerableDevExpress
cpe:2.3:a:devexpress:devexpress:22.1.8:*:*:*:*:*:*:*22.1.8VulnerableDevExpress
cpe:2.3:a:devexpress:devexpress:22.2.4:*:*:*:*:*:*:*22.2.4VulnerableDevExpress
cpe:2.3:a:devexpress:devexpress:22.2.5:*:*:*:*:*:*:*22.2.5VulnerableDevExpress
  • cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:* Versions before 21.2.12 Vulnerable ·DevExpress
  • cpe:2.3:a:devexpress:devexpress:22.1.8:*:*:*:*:*:*:* Versions 22.1.8 Vulnerable ·DevExpress
  • cpe:2.3:a:devexpress:devexpress:22.2.4:*:*:*:*:*:*:* Versions 22.2.4 Vulnerable ·DevExpress
  • cpe:2.3:a:devexpress:devexpress:22.2.5:*:*:*:*:*:*:* Versions 22.2.5 Vulnerable ·DevExpress

Remediation

  • Fix · CNA DevExpress (DevExpress) Fixed in 21.2.12, 22.1.7, 22.1.9, 22.2.3, 22.2.6, 23.1.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    DevExpress 21.2.12, 22.1.7 and 4 more versions

    4 records Highest priority Priority MEDIUM 3 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2023-17901 DevExpress before 23.1.3 allows AsyncDownloader SSRF.Priority MEDIUM 43
    • TI-2023-17899 DevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on XML data.Priority MEDIUM 43
    • TI-2023-17898 DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms.Priority MEDIUM 43
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-35816
  2. 2026-10-03 Alias added: GHSA-22wj-vp2m-rxhc

References

Advisory 1

Other 3

  • TI-2022-11328 Deserialization of untrusted data in DevExpress CVSS 3.1HIGH 8.8
  • TI-2023-17901 DevExpress before 23.1.3 allows AsyncDownloader SSRF. CVSS 3.1CRITICAL 9.8
  • TI-2023-17899 DevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on XML data. CVSS 3.1CRITICAL 9.8
  • TI-2023-17898 DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms. CVSS 3.1CRITICAL 9.8
  • TI-2021-14777 DevExpress.XtraReports.UI through v21.1 allows attackers to execute arbitrary code via insecure deserialization. CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences