PT-2025-18089 · Devexpress · Devexpress

Published 2025-04-28 · Updated 2025-06-05 · CVE-2023-35816

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions DevExpress versions prior to 23.1.3

Description The issue allows for arbitrary TypeConverter conversion. This could potentially lead to unintended consequences, although specific details about the impact or exploitation of this issue are not provided.

Recommendations For versions prior to 23.1.3, update to version 23.1.3 or later to resolve the issue.

Fix

RCE

Relative Path Traversal

Incorrect Type Conversion or Cast

Weakness Enumeration

CWE-23

CWE-704

Related Identifiers

CVE-2023-35816

Affected Products

Devexpress

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2023-35816 · Security Note
• https://osv.dev/vulnerability/CVE-2023-35816 · Vendor Advisory
• https://code-white.com/public-vulnerability-list · Vendor Advisory
• https://twitter.com/CVEnew/status/1916889671524647344 · Twitter Post
• https://t.me/cvenotify/124772 · Telegram Post
• https://supportcenter.devexpress.com/ticket/details/t1159641/net-desktop-and-web-controls-unsafe-data-type-deserialization · Note
• https://t.me/cvetracker/22540 · Telegram Post
• https://t.me/cvedetector/23923 · Telegram Post
• https://supportcenter.devexpress.com/ticket/details/t394936/devexpress-security-advisory-updated-on-april-27-2023 · Note
• https://supportcenter.devexpress.com/ticket/details/t1127422/insecure-arbitrary-typeconverter-conversion · Note