CVE-2023-35817

Description

References

• code-white.com/public-vulnerability-list · Vendor Advisory
• supportcenter.devexpress.com/ticket/details/t1157209/server-side-request-forgery-via-asyncdownloader · Permissions Required
• supportcenter.devexpress.com/ticket/details/t1161404/report-and-dashboard-server-improper-default-configuration-can-lead-to-ssrf-attacks · Permissions Required
• supportcenter.devexpress.com/ticket/details/t1162045/reporting-bi-dashboard-office-file-api-web-app-configuration-to-help-prevent-ssrf-attacks · Permissions Required
• supportcenter.devexpress.com/ticket/details/t394936/devexpress-security-advisory-updated-on-april-27-2023 · Permissions Required

Weitere Schwachstellen in devexpress

• CVE-2023-35816MITTEL 5.3DevExpress before 23.1.3 allows arbitrary TypeConverter conversion.
• CVE-2023-35815KRITISCH 9.8DevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on XML data.
• CVE-2023-35814KRITISCH 9.8DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms.
• CVE-2022-28684HOCH 8.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of DevExpress. Authentication is required to …
• CVE-2021-36483HOCH 8.8DevExpress.XtraReports.UI through v21.1 allows attackers to execute arbitrary code via insecure deserialization.