CVE-2022-41479
First published: Tue Oct 18 2022(Updated: )
The DevExpress Resource Handler (ASPxHttpHandlerModule) in DevExpress ASP.NET Web Forms Build v19.2.3 does not verify the referenced objects in the /DXR.axd?r= HTTP GET parameter. This leads to an Insecure Direct Object References (IDOR) vulnerability which allows attackers to access the application source code.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| DevExpress ASP.NET Web Forms Controls | =19.2.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/IthacaLabs/DevExpress/tree/main/ASP.NET_Web_Forms_Build_19.2.3
- https://supportcenter.devexpress.com/ticket/details/t1171808/penetration-test-idor-source-code-cve-2022-41479
- https://supportcenter.devexpress.com/ticket/details/t190349/false-positive-vulnerabilities-known-alerts-detected-by-various-security-scanners-and
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-41479.
What is the severity of CVE-2022-41479?
The severity of CVE-2022-41479 is high with a CVSS score of 7.5.
What is the affected software?
The affected software is DevExpress ASP.NET Web Forms Controls version 19.2.3.
What is the CWE ID for this vulnerability?
The CWE ID for this vulnerability is CWE-639.
How can I fix CVE-2022-41479?
To fix CVE-2022-41479, upgrade to a version of DevExpress ASP.NET Web Forms Controls that is not affected by this vulnerability.
- agent/type
- agent/softwarecombine
- agent/weakness
- agent/severity
- agent/references
- agent/author
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/first-publish-date
- agent/event
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- vendor/devexpress
- canonical/devexpress asp.net web forms controls
- version/devexpress asp.net web forms controls/19.2.3