CVE-2022-41479: High severity DevExpress Asp.net Web Forms Controls vulnerability
Published Oct 18, 2022
·Updated
The DevExpress Resource Handler (ASPxHttpHandlerModule) in DevExpress ASP.NET Web Forms Build v19.2.3 does not verify the referenced objects in the /DXR.axd?r= HTTP GET parameter. This leads to an Insecure Direct Object References (IDOR) vulnerability which allows attackers to access the application source code.
Affected Software
1 affected component
DevExpress Asp.net Web Forms Controls=19.2.3
Event History
Oct 18, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·02:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-41479.
2
What is the severity of CVE-2022-41479?
The severity of CVE-2022-41479 is high with a CVSS score of 7.5.
3
What is the affected software?
The affected software is DevExpress ASP.NET Web Forms Controls version 19.2.3.
4
What is the CWE ID for this vulnerability?
The CWE ID for this vulnerability is CWE-639.
5
How can I fix CVE-2022-41479?
To fix CVE-2022-41479, upgrade to a version of DevExpress ASP.NET Web Forms Controls that is not affected by this vulnerability.