-
Notifications
You must be signed in to change notification settings - Fork 206
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- 1 new CVEs: CVE-2024-13040 - 0 updated CVEs:
- Loading branch information
cvelistV5 Github Action
committed
Dec 31, 2024
1 parent
404313b
commit a2b9876
Showing
3 changed files
with
152 additions
and
12 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,132 @@ | ||
| { | ||
| "dataType": "CVE_RECORD", | ||
| "dataVersion": "5.1", | ||
| "cveMetadata": { | ||
| "cveId": "CVE-2024-13040", | ||
| "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", | ||
| "state": "PUBLISHED", | ||
| "assignerShortName": "twcert", | ||
| "dateReserved": "2024-12-30T02:15:41.237Z", | ||
| "datePublished": "2024-12-31T01:35:20.576Z", | ||
| "dateUpdated": "2024-12-31T01:35:20.576Z" | ||
| }, | ||
| "containers": { | ||
| "cna": { | ||
| "affected": [ | ||
| { | ||
| "defaultStatus": "unaffected", | ||
| "product": "QOCA aim", | ||
| "vendor": "Quanta Computer", | ||
| "versions": [ | ||
| { | ||
| "status": "affected", | ||
| "version": "0" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "datePublic": "2024-12-31T01:33:00.000Z", | ||
| "descriptions": [ | ||
| { | ||
| "lang": "en", | ||
| "supportingMedia": [ | ||
| { | ||
| "base64": false, | ||
| "type": "text/html", | ||
| "value": "The QOCA aim from Quanta Computer has an Authorization Bypass Through User-Controlled Key vulnerability. By controlling the user ID parameter, remote attackers with regular privileges could access certain features as any user, modify any user's account information and privileges, leading to privilege escalation." | ||
| } | ||
| ], | ||
| "value": "The QOCA aim from Quanta Computer has an Authorization Bypass Through User-Controlled Key vulnerability. By controlling the user ID parameter, remote attackers with regular privileges could access certain features as any user, modify any user's account information and privileges, leading to privilege escalation." | ||
| } | ||
| ], | ||
| "impacts": [ | ||
| { | ||
| "capecId": "CAPEC-233", | ||
| "descriptions": [ | ||
| { | ||
| "lang": "en", | ||
| "value": "CAPEC-233 Privilege Escalation" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "metrics": [ | ||
| { | ||
| "cvssV3_1": { | ||
| "attackComplexity": "LOW", | ||
| "attackVector": "NETWORK", | ||
| "availabilityImpact": "HIGH", | ||
| "baseScore": 8.8, | ||
| "baseSeverity": "HIGH", | ||
| "confidentialityImpact": "HIGH", | ||
| "integrityImpact": "HIGH", | ||
| "privilegesRequired": "LOW", | ||
| "scope": "UNCHANGED", | ||
| "userInteraction": "NONE", | ||
| "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", | ||
| "version": "3.1" | ||
| }, | ||
| "format": "CVSS", | ||
| "scenarios": [ | ||
| { | ||
| "lang": "en", | ||
| "value": "GENERAL" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "problemTypes": [ | ||
| { | ||
| "descriptions": [ | ||
| { | ||
| "cweId": "CWE-639", | ||
| "description": "CWE-639 Authorization Bypass Through User-Controlled Key", | ||
| "lang": "en", | ||
| "type": "CWE" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "providerMetadata": { | ||
| "orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", | ||
| "shortName": "twcert", | ||
| "dateUpdated": "2024-12-31T01:35:20.576Z" | ||
| }, | ||
| "references": [ | ||
| { | ||
| "tags": [ | ||
| "third-party-advisory" | ||
| ], | ||
| "url": "https://www.twcert.org.tw/tw/cp-132-8336-aa03b-1.html" | ||
| }, | ||
| { | ||
| "tags": [ | ||
| "third-party-advisory" | ||
| ], | ||
| "url": "https://www.twcert.org.tw/en/cp-139-8337-7899f-2.html" | ||
| } | ||
| ], | ||
| "solutions": [ | ||
| { | ||
| "lang": "en", | ||
| "supportingMedia": [ | ||
| { | ||
| "base64": false, | ||
| "type": "text/html", | ||
| "value": "<span style=\"background-color: rgb(255, 255, 255);\">Contact the vendor to obtain an update.</span>\n\n<br>" | ||
| } | ||
| ], | ||
| "value": "Contact the vendor to obtain an update." | ||
| } | ||
| ], | ||
| "source": { | ||
| "advisory": "TVN-202412010", | ||
| "discovery": "EXTERNAL" | ||
| }, | ||
| "title": "Quanta Computer QOCA aim - Authorization Bypass", | ||
| "x_generator": { | ||
| "engine": "Vulnogram 0.2.0" | ||
| } | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters