CVE-2023-35815: 
DevExpress Components vulnerability analysis and mitigation

DevExpress before version 23.1.3 contains a vulnerability that allows bypassing the data-source protection mechanism during deserialization of XML data. The vulnerability was discovered in 2023 and affects multiple versions of the DevExpress software suite (MITRE CVE, NVD).

The vulnerability is classified as a deserialization of untrusted data issue (CWE-502). It has been assigned a CVSS v3.1 base score of 3.5 (LOW) with the following vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N. This indicates that the vulnerability requires network access, has high attack complexity, requires low privileges, needs no user interaction, and has a changed scope with low impact on integrity (NVD).

The vulnerability affects the data-source protection mechanism in DevExpress, potentially allowing attackers to bypass security controls during XML deserialization processes. This could lead to unauthorized access to protected data sources (Code White).

The vulnerability affects multiple versions including 22.2.6, 22.2.3, 22.1.9, 22.1.7, and 21.2.12. The low CVSS score and high attack complexity suggest that exploitation may be challenging (Code White).

Users are advised to upgrade to DevExpress version 23.1.3 or later to address this vulnerability (DevExpress Support).