CVE-2024-32641: fallo crítico en MasaCMS
Masa CMS Vulnerable to Pre-Auth RCE via JSON API
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
33Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.8epss 13%
Masa CMS is an open source Enterprise Content Management platform. Masa CMS versions prior to 7.2.8, 7.3.13, and 7.4.6 are vulnerable to remote code execution. The vulnerability exists in the addParam function, which accepts user input via the criteria parameter. This input is subsequently evaluated by setDynamicContent, allowing an unauthenticated attacker to execute arbitrary code via the m tag. The vulnerability is patched in versions 7.2.8, 7.3.13, and 7.4.6.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
MasaCMS · MasaCMSCVEs relacionadas — MasaCMS
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-32640CRITICALMasaCMS SQL Injection vulnerabilityEPSS 78.4%CVE-2026-40330CRITICALMasa CMS SQL injection via sortDirection parameter in beanFeedEPSS 0.4%CVE-2024-32643HIGHMasa CMS vulnerable to authentication bypass with /tag/EPSS 0.4%CVE-2026-40332MEDIUMMasa CMS open redirect via improper handling of scheme-relative URLsEPSS 0.3%CVE-2026-40331CRITICALMasa CMS unauthenticated SQL injection via altTable parameter in JSON APIEPSS 0.3%CVE-2026-40329CRITICALSQL Injection vulnerability via sortBy in beanFeedEPSS 0.3%