CVE-2023-35814 is a low severity flaw (CVSS 3.5) in DevExpress. XtraReport serialized data in ASP.NET Web Forms was not properly protected, which opens the door to unsafe deserialization. The record lists versions before 23.1.3 as affected. Update to 23.1.3 or the fixed release of your branch.
What's affected
The CVE record says DevExpress before 23.1.3 is affected. A researcher list from Code White shows the same issue with several fixed releases by branch: 23.1.3, 22.2.6, 22.2.3, 22.1.9, 22.1.7 and 21.2.12.
The issue is about XtraReport serialized data in ASP.NET Web Forms, so applications that use the DevExpress Web Forms reporting controls are the ones to check. DevExpress publishes its own security advisory at its support centre; the advisory page should be read before you choose a target release.
How to check if you're exposed
List the DevExpress packages in each project:
dotnet list package | grep -i devexpress
For older projects that use assembly references, open the references list or check the version of the DevExpress DLLs in the bin folder. Compare the version with the fixed release for your branch.
Then ask whether the application uses XtraReport in Web Forms at all. If it does not, the practical risk is small even on an old version, though you should still plan the update. A scan of your project files, such as the free dependency scan, can list the DevExpress version and known issues in one pass.
What to do now
- List all applications that include DevExpress components and their versions.
- Update to 23.1.3 or the matching fixed release in your branch, then rebuild and test the reporting pages.
- Review the vendor security advisory for configuration changes that go with the update.
- Where reports are stored or accepted from users, check the source and treat serialized report data as untrusted.
Why it matters
The record classifies this as deserialization of untrusted data (CWE-502). Serialized data turns objects into bytes, and deserialization turns them back. If an attacker can change the bytes and the program trusts them, the program can be made to build objects it never meant to. That class is often serious. Here the score is low because the record asks for high complexity and low privileges, and limits the impact to a small integrity effect.
Two related issues were released together: CVE-2023-35815 covers a data source protection bypass during XML deserialization, and CVE-2023-35817 covers server side request forgery in AsyncDownloader. Fixing them in one upgrade is the efficient path. This CVE is not on the CISA Known Exploited Vulnerabilities list.
Quick check
Is the low score a reason to skip it?
Not necessarily. Plan it with the related DevExpress issues in one upgrade, because they were fixed in the same releases.
Which versions fix it?
23.1.3 for the newest branch, with fixes in older branches listed by Code White. Check the DevExpress advisory for your exact release.
Sources
Last reviewed: 19 October 2026.
