CVE-2023-35814
First published: Mon Apr 28 2025(Updated: )
DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| DevExpress XtraReports | <23.1.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://supportcenter.devexpress.com/ticket/details/t394936/devexpress-security-advisory-updated-on-april-27-2023
- https://code-white.com/public-vulnerability-list/
- https://supportcenter.devexpress.com/ticket/details/t1141158/missing-protection-of-xtrareport-serialized-data-in-asp-net-web-forms
- https://supportcenter.devexpress.com/ticket/details/t1160535/web-reporting-well-formed-request-to-a-report-control-s-backend-can-use
- https://supportcenter.devexpress.com/ticket/details/t1158413/the-allowpassingdatasourceconnectionparameterstoclient-method-may-allow-untrusted-access
Frequently Asked Questions
What is the severity of CVE-2023-35814?
CVE-2023-35814 is classified as a high severity vulnerability due to its impact on data protection.
How do I fix CVE-2023-35814?
To fix CVE-2023-35814, upgrade to DevExpress XtraReports version 23.1.3 or later.
What are the potential impacts of CVE-2023-35814?
The vulnerability can lead to unauthorized access to sensitive serialized data within ASP.NET web forms.
Which versions of DevExpress XtraReports are affected by CVE-2023-35814?
CVE-2023-35814 affects all versions of DevExpress XtraReports prior to 23.1.3.
Is CVE-2023-35814 related to data serialization issues?
Yes, CVE-2023-35814 involves improper protection of serialized data in the XtraReports library.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/source
- agent/author
- agent/severity
- agent/last-modified-date
- agent/tags
- agent/event
- vendor/devexpress
- canonical/devexpress xtrareports