CVE-2023-35816 - Vulnerability Details - OpenCVE

DevExpress before 23.1.3 allows arbitrary TypeConverter conversion.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Changed

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://code-white.com/public-vulnerability-list/
https://supportcenter.devexpress.com/ticket/details/t1127422/insecure-arbitrary-typeconverter-conversion
https://supportcenter.devexpress.com/ticket/details/t1159641/net-desktop-and-web-controls-unsafe-data-type-deserialization
https://supportcenter.devexpress.com/ticket/details/t394936/devexpress-security-advisory-updated-on-april-27-2023

History

Mon, 28 Apr 2025 18:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 28 Apr 2025 16:30:00 +0000

Type	Values Removed	Values Added
References		https://code-white.com/public-vulnerability-list/

Mon, 28 Apr 2025 16:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-23
Metrics		cvssV3_1 `{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N'}`

Mon, 28 Apr 2025 16:00:00 +0000

Type	Values Removed	Values Added
Description		DevExpress before 23.1.3 allows arbitrary TypeConverter conversion.
References		https://supportcenter.devexpress.com/ticket/details/t1127422/insecure-arbitrary-typeconverter-conversion https://supportcenter.devexpress.com/ticket/details/t1159641/net-desktop-and-web-controls-unsafe-data-type-deserialization https://supportcenter.devexpress.com/ticket/details/t394936/devexpress-security-advisory-updated-on-april-27-2023

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2025-04-28T00:00:00.000Z

Updated: 2025-04-28T18:08:07.672Z

Reserved: 2023-06-17T00:00:00.000Z

Link: CVE-2023-35816

Vulnrichment

Updated: 2025-04-28T18:08:03.624Z

NVD

Status : Awaiting Analysis

Published: 2025-04-28T16:15:26.300

Modified: 2025-04-29T13:52:10.697

Link: CVE-2023-35816

Redhat

No data.

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2023-35816", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2025-04-28T18:08:07.672Z", "dateReserved": "2023-06-17T00:00:00.000Z", "datePublished": "2025-04-28T00:00:00.000Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "DevExpress", "vendor": "DevExpress", "versions": [{"lessThan": "21.2.12", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "22.1.7", "status": "affected", "version": "22", "versionType": "custom"}, {"lessThan": "22.1.9", "status": "affected", "version": "22.1.8", "versionType": "custom"}, {"lessThan": "22.2.3", "status": "affected", "version": "22.2", "versionType": "custom"}, {"lessThan": "22.2.6", "status": "affected", "version": "22.2.4", "versionType": "custom"}, {"lessThan": "23.1.3", "status": "affected", "version": "23", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "DevExpress before 23.1.3 allows arbitrary TypeConverter conversion."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-23", "description": "CWE-23 Relative Path Traversal", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2025-04-28T16:12:05.415Z"}, "references": [{"url": "https://supportcenter.devexpress.com/ticket/details/t394936/devexpress-security-advisory-updated-on-april-27-2023"}, {"url": "https://supportcenter.devexpress.com/ticket/details/t1159641/net-desktop-and-web-controls-unsafe-data-type-deserialization"}, {"url": "https://code-white.com/public-vulnerability-list/"}, {"url": "https://supportcenter.devexpress.com/ticket/details/t1127422/insecure-arbitrary-typeconverter-conversion"}], "x_generator": {"engine": "enrichogram 0.0.1"}, "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 3.5, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N"}}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*", "versionEndExcluding": "21.2.12"}, {"vulnerable": true, "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*", "versionStartIncluding": "22", "versionEndExcluding": "22.1.7"}, {"vulnerable": true, "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*", "versionStartIncluding": "22.1.8", "versionEndExcluding": "22.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*", "versionStartIncluding": "22.2", "versionEndExcluding": "22.2.3"}, {"vulnerable": true, "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*", "versionStartIncluding": "22.2.4", "versionEndExcluding": "22.2.6"}, {"vulnerable": true, "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*", "versionStartIncluding": "23", "versionEndExcluding": "23.1.3"}]}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-28T18:08:00.826540Z", "id": "CVE-2023-35816", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-28T18:08:07.672Z"}}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-35816", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-28T18:08:00.826540Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-28T18:08:03.624Z"}}], "cna": {"metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 3.5, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N"}}], "affected": [{"vendor": "DevExpress", "product": "DevExpress", "versions": [{"status": "affected", "version": "0", "lessThan": "21.2.12", "versionType": "custom"}, {"status": "affected", "version": "22", "lessThan": "22.1.7", "versionType": "custom"}, {"status": "affected", "version": "22.1.8", "lessThan": "22.1.9", "versionType": "custom"}, {"status": "affected", "version": "22.2", "lessThan": "22.2.3", "versionType": "custom"}, {"status": "affected", "version": "22.2.4", "lessThan": "22.2.6", "versionType": "custom"}, {"status": "affected", "version": "23", "lessThan": "23.1.3", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://supportcenter.devexpress.com/ticket/details/t394936/devexpress-security-advisory-updated-on-april-27-2023"}, {"url": "https://supportcenter.devexpress.com/ticket/details/t1159641/net-desktop-and-web-controls-unsafe-data-type-deserialization"}, {"url": "https://code-white.com/public-vulnerability-list/"}, {"url": "https://supportcenter.devexpress.com/ticket/details/t1127422/insecure-arbitrary-typeconverter-conversion"}], "x_generator": {"engine": "enrichogram 0.0.1"}, "descriptions": [{"lang": "en", "value": "DevExpress before 23.1.3 allows arbitrary TypeConverter conversion."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-23", "description": "CWE-23 Relative Path Traversal"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "21.2.12"}, {"criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "22.1.7", "versionStartIncluding": "22"}, {"criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "22.1.9", "versionStartIncluding": "22.1.8"}, {"criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "22.2.3", "versionStartIncluding": "22.2"}, {"criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "22.2.6", "versionStartIncluding": "22.2.4"}, {"criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "23.1.3", "versionStartIncluding": "23"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2025-04-28T16:12:05.415Z"}}}, "cveMetadata": {"cveId": "CVE-2023-35816", "state": "PUBLISHED", "dateUpdated": "2025-04-28T18:08:07.672Z", "dateReserved": "2023-06-17T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2025-04-28T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.1"}