PT-2022-19168 · Devexpress · Safebinaryformatter+1

Markus Wulftange + 1 · Published 2022-06-24 · Updated 2025-05-24 · CVE-2022-28684

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DevExpress (affected versions not specified)

Description This issue allows remote attackers to execute arbitrary code on affected installations. Authentication is required to exploit this issue. The flaw exists within the SafeBinaryFormatter library due to the lack of proper validation of user-supplied data, resulting in deserialization of untrusted data. An attacker can leverage this issue to execute code in the context of the service account.

Recommendations At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2022-28684

ZDI-22-872

Affected Products

Devexpress

Safebinaryformatter

References · 8

• https://zerodayinitiative.com/advisories/ZDI-22-872 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-28684 · Security Note
• https://osv.dev/vulnerability/CVE-2022-28684 · Vendor Advisory
• https://t.me/cibsecurity/47504 · Telegram Post
• https://t.me/offensivetwitter/759 · Telegram Post
• https://twitter.com/JacquesGariepy/status/1926350320818348268 · Twitter Post
• https://t.me/pentestingnews/25066 · Telegram Post
• https://t.me/cybersecuritytechnologies/6298 · Telegram Post