TVN ID	TVN-202412010
CVE ID	CVE-2024-13040
CVSS	8.8 (High) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products	QOCA aim
Description	The QOCA aim from Quanta Computer has an Authorization Bypass Through User-Controlled Key vulnerability. By controlling the user ID parameter, remote attackers with regular privileges could access certain features as any user, modify any user's account information and privileges, leading to privilege escalation.
Solution	Contact the vendor to obtain an update.
Credit	Alan Chung、Mico Kao(DEVCORE)
Public Date	2024-12-30