← All advisories

Medium severity5.0NVD Advisory· Published Apr 28, 2025· Updated Jun 17, 2026

CVE-2023-35817

CVE-2023-35817

Description

DevExpress before 23.1.3 allows AsyncDownloader SSRF.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

7

Devexpress/DevExpress6 versions
cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*+ 5 more
- cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*range: <21.2.12
- cpe:2.3:a:devexpress:devexpress:22.1.8:*:*:*:*:*:*:*
- cpe:2.3:a:devexpress:devexpress:22.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:devexpress:devexpress:22.2.5:*:*:*:*:*:*:*
- (no CPE)range: <23.1.3
- (no CPE)range: 0
Devexpress/AsyncDownloaderllm-create
Range: <23.1.3

Patches

Vulnerability mechanics

References

5

code-white.com/public-vulnerability-list/nvdVendor Advisory
supportcenter.devexpress.com/ticket/details/t1157209/server-side-request-forgery-via-asyncdownloadernvdPermissions Required
supportcenter.devexpress.com/ticket/details/t1161404/report-and-dashboard-server-improper-default-configuration-can-lead-to-ssrf-attacksnvdPermissions Required
supportcenter.devexpress.com/ticket/details/t1162045/reporting-bi-dashboard-office-file-api-web-app-configuration-to-help-prevent-ssrf-attacksnvdPermissions Required
supportcenter.devexpress.com/ticket/details/t394936/devexpress-security-advisory-updated-on-april-27-2023nvdPermissions Required

News mentions

0

No linked articles in our index yet.