CVE-2024-32642: high-severity vulnerability in MasaCMS
Host header poisoning allows account takeover via password reset email
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8epss 0.2%
Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, there is vulnerable to host header poisoning which allows account takeover via password reset email. This vulnerability is fixed in 7.2.8, 7.3.13, and 7.4.6.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
MasaCMS · MasaCMSRelated CVEs — MasaCMS
In the same product, most dangerous first.
CVE-2024-32640CRITICALMasaCMS SQL Injection vulnerabilityEPSS 78.4%CVE-2024-32641CRITICALMasa CMS Vulnerable to Pre-Auth RCE via JSON APIEPSS 13.1%CVE-2026-40330CRITICALMasa CMS SQL injection via sortDirection parameter in beanFeedEPSS 0.4%CVE-2024-32643HIGHMasa CMS vulnerable to authentication bypass with /tag/EPSS 0.4%CVE-2026-40332MEDIUMMasa CMS open redirect via improper handling of scheme-relative URLsEPSS 0.3%CVE-2026-40331CRITICALMasa CMS unauthenticated SQL injection via altTable parameter in JSON APIEPSS 0.3%