CVE-2024-13040
Quanta Computer QOCA aim - Authorization Bypass
- State
- Published
- Severity
- 8.8 High
- Published
- Dec 31, 2024
- Updated
- Dec 31, 2024
- Reserved
- Dec 30, 2024
Description
The QOCA aim from Quanta Computer has an Authorization Bypass Through User-Controlled Key vulnerability. By controlling the user ID parameter, remote attackers with regular privileges could access certain features as any user, modify any user's account information and privileges, leading to privilege escalation.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | twcert |
Weaknesses
- CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products
| Product | Versions |
|---|---|
QOCA aimQuanta Computer |
|
References
- https://www.twcert.org.tw/tw/cp-132-8336-aa03b-1.htmlthird-party-advisory
- https://www.twcert.org.tw/en/cp-139-8337-7899f-2.htmlthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.