CVE-2023-35817

DevExpress before 23.1.3 allows AsyncDownloader SSRF.

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - cve@mitre.org

Published

2025-04-28

Last modified

2025-04-28

Weaknesses

CWE-918

Affected products

• Devexpress (Devexpress)

References

• https://code-white.com/public-vulnerability-list/
• https://supportcenter.devexpress.com/ticket/details/t1157209/server-side-request-forgery-via-asyncdownloader
• https://supportcenter.devexpress.com/ticket/details/t1161404/report-and-dashboard-server-improper-default-configuration…
• https://supportcenter.devexpress.com/ticket/details/t1162045/reporting-bi-dashboard-office-file-api-web-app-configurati…
• https://supportcenter.devexpress.com/ticket/details/t394936/devexpress-security-advisory-updated-on-april-27-2023