TI-2024-21523 Aliases CVE-2024-32641

Masa CMS Vulnerable to Pre-Auth RCE via JSON API

HIGH 82CWE-94Published 2025-12-03 · Updated 2025-12-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

Masa CMS is an open source Enterprise Content Management platform. Masa CMS versions prior to 7.2.8, 7.3.13, and 7.4.6 are vulnerable to remote code execution. The vulnerability exists in the addParam function, which accepts user input via the criteria parameter. This input is subsequently evaluated by setDynamicContent, allowing an unauthenticated attacker to execute arbitrary code via the m tag. The vulnerability is patched in versions 7.2.8, 7.3.13, and 7.4.6.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.13144 96th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed MasaCMS (MasaCMS): 7.4.6, 7.3.13, 7.2.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
MasaCMS	MasaCMS	7.4.0 to before 7.4.6; 7.3.0 to before 7.3.13; before 7.2.8	7.4.6, 7.3.13, 7.2.8	Patch available	CNA

MasaCMS VendorMasaCMS Affected 7.4.0 to before 7.4.6; 7.3.0 to before 7.3.13; before 7.2.8 Fixed in 7.4.6, 7.3.13, 7.2.8 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:masacms:masacms::::::::	before 7.2.8; 7.3 to before 7.3.13; 7.4.0 to before 7.4.6	Vulnerable	MasaCMS

cpe:2.3:a:masacms:masacms:*:*:*:*:*:*:*:* Versions before 7.2.8; 7.3 to before 7.3.13; 7.4.0 to before 7.4.6 Vulnerable ·MasaCMS

Remediation

Fix · CNA MasaCMS (MasaCMS) Fixed in 7.4.6, 7.3.13, 7.2.8

Timeline

2026-10-02 Threatist record created from CVE-2024-32641

References

Exploit 1

https://github.com/MasaCMS/MasaCMS/security/advisories/GHSA-cj9g-v5mq-qrjm

Patch 1

https://github.com/MasaCMS/MasaCMS/commit/fb27f822fe426496af71205fa35208e58823fcf6

TI-2024-21524 Host header poisoning allows account takeover via password reset email CVSS 3.1HIGH 8.8
TI-2024-21525 Masa CMS vulnerable to authentication bypass with /tag/ CVSS 3.1HIGH 7.5
TI-2022-23274 A vulnerability in the Remember Me function of Masa CMS v7.2, 7.3, and 7.4-beta allows… CVSS 3.1CRITICAL 9.8
TI-2021-18659 MasaCMS 7.2.1 is affected by a path traversal vulnerability in /index.cfm/_api/asset/image/. CVSS 3.1HIGH 7.5
TI-2025-40916 Masa CMS vulnerable to Cross-Site Scripting (XSS) through URL Parameter CVSS 3.1HIGH 8.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences