CVE-2023-35814

low-risk
Published 2025-04-28

DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms.

Do I need to act?

-
0.55% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
3
CVSS 3.5/10 Low
NETWORK / HIGH complexity

Affected Products (4)

Devexpress
Devexpress
Devexpress
Devexpress

Affected Vendors

Devexpress

References (5)

Vendor Advisory https://code-white.com/public-vulnerability-list/
Permissions Required https://supportcenter.devexpress.com/ticket/details/t1141158/missing-protection-...
Permissions Required https://supportcenter.devexpress.com/ticket/details/t1158413/the-allowpassingdat...
Permissions Required https://supportcenter.devexpress.com/ticket/details/t1160535/web-reporting-well-...
Permissions Required https://supportcenter.devexpress.com/ticket/details/t394936/devexpress-security-...
24
/ 100
low-risk
Severity 12/34 · Low
Exploitability 2/34 · Minimal
Exposure 10/34 · Low