CVE-2022-41479

The DevExpress Resource Handler (ASPxHttpHandlerModule) in DevExpress ASP.NET Web Forms Build v19.2.3 does not verify the referenced objects in the /DXR.axd?r= HTTP GET parameter. This leads to an Insecure Direct Object References (IDOR) vulnerability which allows attackers to access the application source code. NOTE: the vendor disputes this because the retrieved source code is only the DevExpress client-side application code that is, of course, intentionally readable by web browsers (a site's custom code and data is never accessible via an IDOR approach).

• CWE-639
• CWE-639

• https://github.com/IthacaLabs/DevExpress/tree/main/ASP.NET_Web_Forms_Build_19.2.3Exploit, Third Party Advisory
• https://supportcenter.devexpress.com/ticket/details/t1171808/penetration-test-idor-source-code-cve-2022-41479
• https://supportcenter.devexpress.com/ticket/details/t190349/false-positive-vulnerabilities-known-alerts-detected-by-various-security-scanners-and
• https://github.com/IthacaLabs/DevExpress/tree/main/ASP.NET_Web_Forms_Build_19.2.3Exploit, Third Party Advisory

Published

Oct 18, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-4147174cmsSE v3.12.0 allows authenticated attackers with low-leve…6.5
• CVE-2022-4147274cmsSE v3.12.0 was discovered to contain a cross-site scrip…5.4
• CVE-2022-41473RPCMS v3.0.2 was discovered to contain a reflected cross-sit…6.1
• CVE-2022-41474RPCMS v3.0.2 was discovered to contain a Cross-Site Request …6.5
• CVE-2022-41475RPCMS v3.0.2 was discovered to contain a Cross-Site Request …8.8
• CVE-2022-41477A security issue was discovered in WeBid <=1.2.2. A Server-S…9.1
• CVE-2022-4148The WP OAuth Server (OAuth Authentication) WordPress plugin …4.3
• CVE-2022-41480Tenda AC1200 US_AC6V2.0RTL_V15.03.06.51_multi_TDE01 was disc…7.5
• CVE-2022-41481Tenda AC1200 US_AC6V2.0RTL_V15.03.06.51_multi_TDE01 was disc…7.5
• CVE-2022-41482Tenda AC1200 US_AC6V2.0RTL_V15.03.06.51_multi_TDE01 was disc…7.5
• CVE-2022-41483Tenda AC1200 US_AC6V2.0RTL_V15.03.06.51_multi_TDE01 was disc…7.5
• CVE-2022-41484Tenda AC1900 AP500(US)_V1_180320(Beta) was discovered to con…7.5