CVE-2022-28684: 
DevExpress Components vulnerability analysis and mitigation

CVE-2022-28684 is a remote code execution vulnerability in DevExpress that was discovered in March 2022 and publicly disclosed on June 24, 2022. The vulnerability affects multiple versions of DevExpress software from version 18.1.0 through 22.1.0. This security flaw requires authentication to exploit and received a CVSS score of 8.8 (ZDI Advisory).

The vulnerability exists within the SafeBinaryFormatter library of DevExpress. The specific issue stems from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. The vulnerability has been assigned a CVSS v3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating a high severity rating (ZDI Advisory, NVD).

If successfully exploited, this vulnerability allows an authenticated attacker to execute arbitrary code in the context of the service account. This could potentially lead to complete system compromise within the scope of the affected service (ZDI Advisory).

The vulnerability requires authentication to exploit, meaning an attacker must have valid credentials to the affected system. The attack can be performed remotely, and no user interaction is required once the attacker has authenticated (ZDI Advisory).

DevExpress has released multiple version updates to address this vulnerability. The following versions contain the fix: v22.1.1, v21.2.7, v21.1.9, v20.2.11, v20.1.15, v19.2.14, v19.1.15, v18.2.17, and v18.1.18. Users are advised to upgrade to these patched versions to mitigate the vulnerability (ZDI Advisory).