CVE-2022-27233

highpriority · track · 30EPSS 0.007 · 52 %ileEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.66% (52nd) EPSS

CVSS 7.5 · high

Is it mine?

3 products

Check your exposure

Who says so?

3 sources

cnnvd · enisa_euvd · nvd

EPSS · scored 2026-10-28

XML injection in the Quartus(R) Prime Programmer included in the Intel(R) Quartus Prime Pro and Standard edition software may allow an unauthenticated user to potentially enable information disclosure via network access.

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.5–7.5

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 3.6

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:Nsecondary · ENISA EU

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:Nsecondary · secure@intel.comexploitability 2.8 · impact 3.6

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-91USprimary

affected products (3)

Products and version ranges known to be affected.

n/a Intel(R) Quartus Prime Pro and Standard edition software≤ See referenceenisa_euvdEU
intel quartus prime≤ 21.1nvdUScpe:2.3:a:intel:quartus_prime:*:*:*:*:*:*:*:*
intel quartus prime< 22.1nvdUScpe:2.3:a:intel:quartus_prime:*:*:*:*:*:*:*:*

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd nvd NVD CVE.org MITRE

published 2022-11-11modified 2026-06-17

related (202)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2020-1147US	high7.8OT critical	94.0% (100th)	KEV	2020-07-14
A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.…
CVE-2020-0646US	critical9.8OT critical	99.2% (100th)	KEV	2020-01-14
A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'.
CVE-2023-46214US	high8.8	89.2% (100th)	Exploit	2023-11-16
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means…
CVE-2023-27253US	high8.8	89.5% (100th)	Exploit	2023-03-17
A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0 allows authenticated attackers to execute arbitrary commands via manipulating the cont…
CVE-2008-0016US	high10.0	43.9% (99th)	Exploit	2008-09-24
Stack-based buffer overflow in the URL parsing implementation in Mozilla Firefox before 2.0.0.17 and SeaMonkey before 1.1.12 allows remote attackers to execute arbitrary code via a…

+197 more

references (5)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan