Lucene search

[email protected]CVE-2022-41479

HistoryOct 18, 2022 - 2:15 p.m.

CVE-2022-41479

2022-10-1814:15:09

CWE-639

[email protected]

web.nvd.nist.gov

cve-2022-41479

devexpress

asp.net

web forms

build v19.2.3

insecure direct object references vulnerability

idor

source code access

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

0.002 Low

EPSS

Percentile

58.8%

JSON

The DevExpress Resource Handler (ASPxHttpHandlerModule) in DevExpress ASP.NET Web Forms Build v19.2.3 does not verify the referenced objects in the /DXR.axd?r= HTTP GET parameter. This leads to an Insecure Direct Object References (IDOR) vulnerability which allows attackers to access the application source code.

Affected configurations

NVD

Node

devexpressasp.net_web_forms_controlsMatch19.2.3

CPENameOperatorVersion
devexpress:asp.net_web_forms_controlsdevexpress asp.net web forms controlseq19.2.3

CPE	Name	Operator	Version
devexpress:asp.net_web_forms_controls	devexpress asp.net web forms controls	eq	19.2.3

References

github.com/IthacaLabs/DevExpress/tree/main/ASP.NET_Web_Forms_Build_19.2.3

Social References

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

0.002 Low

EPSS

Percentile

58.8%

JSON

Related for CVE-2022-41479

prion1 cvelist1 nvd1