Improper XML Entity Reference in Intel Quartus Prime Pro Edition
CVE-2022-21205

7.5HIGH

Key Information:

Vendor

Intel
Status
Intel(r) Quartus(r) Prime Pro Edition
Vendor
CVE Published:
9 February 2022

What is CVE-2022-21205?

The DSP Builder Pro for Intel Quartus Prime Pro Edition has a vulnerability due to improper handling of XML external entities that can be exploited by unauthenticated users. This issue may enable attackers to gain unauthorized access to sensitive information via network interactions. Users are advised to update to version 21.3 or later to mitigate this risk.

Affected Version(s)

Intel(R) Quartus(R) Prime Pro Edition before version 21.3

References

https://www.intel.com/content/www/us/en/security-center/a...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2022-21205 : Improper XML Entity Reference in Intel Quartus Prime Pro Edition