PT-2020-4944 · Intel · Intel Quartus Prime Standard+1

Published 2020-11-10 · Updated 2020-12-01 · CVE-2020-24454

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Intel Quartus Prime Pro versions prior to 20.3 Intel Quartus Prime Standard versions prior to 20.2

Description: The issue is related to improper restriction of XML external entity references, which could allow a remote attacker to gain unauthorized access to protected information. This may enable information disclosure via network access.

Recommendations: For Intel Quartus Prime Pro versions prior to 20.3, update to version 20.3 or later. For Intel Quartus Prime Standard versions prior to 20.2, update to version 20.2 or later.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2020-05519

CVE-2020-24454

Affected Products

Intel Quartus Prime Pro

Intel Quartus Prime Standard

References · 6

• https://osv.dev/vulnerability/CVE-2020-24454 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-05519 · Security Note
• https://intel.com/content/www/us/en/security-center/advisory/intel-sa-00446 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24454 · Security Note
• https://intel.com/content/www/us/en/security-center/advisory/intel-sa-00446.html · Note
• https://cybersecurity-help.cz/vdb/SB2020111114 · Note