DevExpress code execution | CVE-2022-28684
NAME
DevExpress code execution
- Platforms Affected:
DevExpress DevExpress - Risk Level:
8.8 - Exploitability:
Unproven - Consequences:
Gain Access
DESCRIPTION
DevExpress could allow a remote authenticated attacker to execute arbitrary code on the system, caused by deserialization of untrusted Data in the SafeBinaryFormatter library. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS 3.0 Information
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Access Vector: Network
- Access Complexity: Low
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
- Remediation Level: Official Fix
MITIGATION
Upgrade to the latest version of DevExpress (22.1.1, 21.2.7, 21.1.9, 20.2.11, 20.1.15, 19.2.14, 19.1.15. 18.2.17, 18.1.18 or later), available from the DevExpress Web site. See References.
- Reference Link:
https://www.zerodayinitiative.com/advisories/ZDI-22-872/ - Reference Link:
https://www.devexpress.com/
If you like the site, please consider joining the telegram channel and supporting us on Patreon using the button below.
