SB2023030815 - Multiple vulnerabilities in Intel Quartus Prime Pro and Standard Editions

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023030815

SB2023030815 - Multiple vulnerabilities in Intel Quartus Prime Pro and Standard Editions

Published: March 8, 2023

Security Bulletin ID SB2023030815
Severity
Low
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 secuirty vulnerabilities.


1) Path traversal (CVE-ID: CVE-2022-33892)

The vulnerability allows a local user to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences. A local user can send a specially crafted HTTP request and gain elevated privileges on the system.


2) Insufficient Control Flow Management (CVE-ID: CVE-2022-33902)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insufficient control flow management, which leads to security restrictions bypass and privilege escalation.


3) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2022-26840)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper neutralization, which leads to security restrictions bypass and privilege escalation.


4) Improper Authentication (CVE-ID: CVE-2022-32570)

The vulnerability allows a local user to bypass authentication process.

The vulnerability exists due to an error in when processing authentication requests. A local user can bypass authentication process and gain elevated privileges on the system.


5) Cross-site scripting (CVE-ID: CVE-2022-26888)

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.


Remediation

Install update from vendor's website.

References