CVEvulnerability

CVE-2024-32642

8.8 HIGH Published 2025-12-03 Modified 2026-09-26 Official page ↗
Status
Analyzed
Published
2025-12-03
Last modified
2026-09-26
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-346, CWE-640

Description

Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, there is vulnerable to host header poisoning which allows account takeover via password reset email. This vulnerability is fixed in 7.2.8, 7.3.13, and 7.4.6.

Affected configurations

• masacms masacms (< 7.2.8) • masacms masacms (>= 7.3 < 7.3.13) • masacms masacms (>= 7.4.0 < 7.4.6)

Related

Weakness · CWE (2)

  • CWE-346 Origin Validation Error weakness
  • CWE-640 Weak Password Recovery Mechanism for Forgotten Password weakness

References