PT-2025-18089 · Devexpress · Devexpress

Publicado 2025-04-28 · Atualizado 2025-06-05 · CVE-2023-35816

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions DevExpress versions prior to 23.1.3

Description The issue allows for arbitrary TypeConverter conversion. This could potentially lead to unintended consequences, although specific details about the impact or exploitation of this issue are not provided.

Recommendations For versions prior to 23.1.3, update to version 23.1.3 or later to resolve the issue.

Correção

RCE

Relative Path Traversal

Incorrect Type Conversion or Cast

Enumeração de Fraquezas

CWE-23

CWE-704

Identificadores relacionados

CVE-2023-35816

Produtos afetados

Devexpress

Referências · 10

• https://twitter.com/CVEnew/status/1916889671524647344 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-35816 · Nota de Segurança
• https://t.me/cvenotify/124772 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-35816 · Aviso do Fabricante
• https://code-white.com/public-vulnerability-list · Aviso do Fabricante
• https://supportcenter.devexpress.com/ticket/details/t1159641/net-desktop-and-web-controls-unsafe-data-type-deserialization · Nota
• https://t.me/cvetracker/22540 · Publicação no Telegram
• https://t.me/cvedetector/23923 · Publicação no Telegram
• https://supportcenter.devexpress.com/ticket/details/t394936/devexpress-security-advisory-updated-on-april-27-2023 · Nota
• https://supportcenter.devexpress.com/ticket/details/t1127422/insecure-arbitrary-typeconverter-conversion · Nota