CVE-2024-32642

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-32642
Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, there is vulnerable to host header poisoning which allows account takeover via password reset email. This vulnerability is fixed in 7.2.8, 7.3.13, and 7.4.6.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/MasaCMS/MasaCMS/commit/7541b9c99fb9e32d1de6f2658750525cec1d8960 Patch
https://github.com/MasaCMS/MasaCMS/security/advisories/GHSA-qjm6-c8hx-ffh8 Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:masacms:masacms:*:*:*:*:*:*:*:*
cpe:2.3:a:masacms:masacms:*:*:*:*:*:*:*:*
cpe:2.3:a:masacms:masacms:*:*:*:*:*:*:*:*
History

05 Dec 2025, 15:36

Type Values Removed Values Added
References () https://github.com/MasaCMS/MasaCMS/commit/7541b9c99fb9e32d1de6f2658750525cec1d8960 - () https://github.com/MasaCMS/MasaCMS/commit/7541b9c99fb9e32d1de6f2658750525cec1d8960 - Patch
References () https://github.com/MasaCMS/MasaCMS/security/advisories/GHSA-qjm6-c8hx-ffh8 - () https://github.com/MasaCMS/MasaCMS/security/advisories/GHSA-qjm6-c8hx-ffh8 - Exploit, Vendor Advisory
First Time Masacms
Masacms masacms
CPE cpe:2.3:a:masacms:masacms:*:*:*:*:*:*:*:*

03 Dec 2025, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-12-03 17:15

Updated : 2025-12-05 15:36

NVD link : CVE-2024-32642

Mitre link : CVE-2024-32642

CVE.ORG link : CVE-2024-32642

JSON object : View

Products Affected

masacms

  • masacms
CWE
CWE-346

Origin Validation Error

CWE-640

Weak Password Recovery Mechanism for Forgotten Password