CVE-2020-24454

Improper Restriction of XML External Entity Reference in subsystem forIntel(R) Quartus(R) Prime Pro Edition before version 20.3 and Intel(R) Quartus(R) Prime Standard Edition before version 20.2 may allow unauthenticated user to potentially enable information disclosure via network access.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00446	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:intel:quartus_prime:::::standard:::*
	cpe:2.3:a:intel:quartus_prime:::::pro:::*

History

No history.

Information

Published : 2020-11-12 19:15

Updated : 2023-12-10 13:41

NVD link : CVE-2020-24454

Mitre link : CVE-2020-24454

CVE.ORG link : CVE-2020-24454

JSON object : View

Products Affected

intel

quartus_prime

CWE

CWE-611

Improper Restriction of XML External Entity Reference

{"id": "CVE-2020-24454", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2020-11-12T19:15:14.660", "references": [{"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00446", "tags": ["Patch", "Vendor Advisory"], "source": "secure@intel.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-611"}]}], "descriptions": [{"lang": "en", "value": "Improper Restriction of XML External Entity Reference in subsystem forIntel(R) Quartus(R) Prime Pro Edition before version 20.3 and Intel(R) Quartus(R) Prime Standard Edition before version 20.2 may allow unauthenticated user to potentially enable information disclosure via network access."}, {"lang": "es", "value": "Una Restricci\u00f3n Inapropiada de XML External Entity Reference en el subsistema para Intel\u00ae Quartus\u00ae Prime Pro Edition anterior a versi\u00f3n 20.3 e Intel\u00ae Quartus\u00ae Prime Standard Edition anterior a versi\u00f3n 20.2, puede habilitar a un usuario no autenticado para permitir potencialmente una divulgaci\u00f3n de informaci\u00f3n por medio de un acceso de red"}], "lastModified": "2020-12-01T17:57:22.997", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:intel:quartus_prime:*:*:*:*:standard:*:*:*", "vulnerable": true, "matchCriteriaId": "4410B823-BB43-4EB2-B21D-99181434D609", "versionEndIncluding": "20.1"}, {"criteria": "cpe:2.3:a:intel:quartus_prime:*:*:*:*:pro:*:*:*", "vulnerable": true, "matchCriteriaId": "B193A718-AD5B-48D2-A6A5-4FF332FFA6B6", "versionEndExcluding": "20.3"}], "operator": "OR"}]}], "sourceIdentifier": "secure@intel.com"}