Medium severity · published Feb 16, 2023
CVE-2022-26888
Cross-site scripting in the Intel(R) Quartus Prime Pro and Standard edition software may allow an authenticated user to potentially enable information disclosure via local access
4.1
CVSS
0.3%
EPSS
No
On KEV
Description
Cross-site scripting in the Intel(R) Quartus Prime Pro and Standard edition software may allow an authenticated user to potentially enable information disclosure via local access.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QP
Quartus Prime · Intel
before 22.1; before 22.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-26888
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-26888
Vendor Advisory
http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00714.html
More from Quartus Prime
7.8
CVE-2024-38668
Uncontrolled search path for some Intel(R) Quartus(R) Prime Standard Edition software for Windows before version 23.1.1 may allow an authenticated user to potentially enable…
7.8
CVE-2024-38383
Uncontrolled search path for some Intel(R) Quartus(R) Prime Pro Edition software for Windows before version 24.2 may allow an authenticated user to potentially enable escalation…
7.8
CVE-2024-23907
Uncontrolled search path in some Intel(R) High Level Synthesis Compiler software before version 23.4 may allow an authenticated user to potentially enable escalation of privilege…
7.8
CVE-2024-22184
Uncontrolled search path for some Intel(R) Quartus(R) Prime Pro Edition Design Software before version 24.1 may allow an authenticated user to potentially enable escalation of…
7.8
CVE-2022-41693
Uncontrolled search path in the Intel(R) Quartus(R) Prime Pro edition software before version 22.3 may allow an authenticated user to potentially enable escalation of privilege…