Medium severity · published Feb 16, 2023
CVE-2022-26888
Cross-site scripting in the Intel(R) Quartus Prime Pro and Standard edition software may allow an authenticated user to potentially enable information disclosure via local access
4.1
CVSS
0.3%
EPSS
No
On KEV
Description
Cross-site scripting in the Intel(R) Quartus Prime Pro and Standard edition software may allow an authenticated user to potentially enable information disclosure via local access.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IQ
Intel(R) Quartus Prime Pro and Standard edition software ·
See references · source: vendor
QP
Quartus Prime · Intel
before 22.1; before 22.2 · source: NVD
Affected product
IQ
Intel(R) Quartus Prime Pro and Standard edition software
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-26888
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-26888
Vendor Advisory
http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00714.html
More from Intel(R) Quartus Prime Pro and Standard edition software
7.8
CVE-2022-32570
Improper authentication in the Intel(R) Quartus Prime Pro and Standard edition software may allow an authenticated user to potentially enable escalation of privilege via local…
7.8
CVE-2022-26840
Improper neutralization in the Intel(R) Quartus Prime Pro and Standard edition software may allow an authenticated user to potentially enable escalation of privilege via local…
7.8
CVE-2022-33902
Insufficient control flow management in the Intel(R) Quartus Prime Pro and Standard edition software may allow an authenticated user to potentially enable escalation of privilege…
7.8
CVE-2022-33892
Path traversal in the Intel(R) Quartus Prime Pro and Standard edition software may allow an authenticated user to potentially enable escalation of privilege via local access
7.5
CVE-2022-27233
XML injection in the Quartus(R) Prime Programmer included in the Intel(R) Quartus Prime Pro and Standard edition software may allow an unauthenticated user to potentially enable…