Remote Code Execution Vulnerability in Masa CMS by Masa Systems
CVE-2024-32641
9.8CRITICAL
What is CVE-2024-32641?
Masa CMS is an open-source Enterprise Content Management platform that suffered from a vulnerability in the addParam function. This vulnerability allows an unauthenticated attacker to inject arbitrary code through user input in the criteria parameter. The exploited input is then processed by setDynamicContent, which creates a pathway for remote code execution via the m tag. Users are strongly advised to upgrade to Masa CMS versions 7.2.8, 7.3.13, or 7.4.6 to mitigate this risk.
Affected Version(s)
MasaCMS >= 7.4.0, < 7.4.6 < 7.4.0, 7.4.6
MasaCMS >= 7.3.0, < 7.3.13 < 7.3.0, 7.3.13
MasaCMS < 7.2.8 < 7.2.8
References
EPSS Score
12% chance of being exploited in the next 30 days.
CVSS V3.1
Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved