PT-2025-48945 · Masacms · Masacms

Published 2025-12-03 · Updated 2025-12-08 · CVE-2024-32642

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Masa CMS versions prior to 7.2.8 Masa CMS versions prior to 7.3.13 Masa CMS versions prior to 7.4.6

Description Masa CMS is susceptible to a host header poisoning issue that can lead to account takeover through the password reset email functionality. The issue occurs when the application does not properly validate the host header, allowing an attacker to manipulate the password reset link and redirect the user to a malicious domain controlled by the attacker. This allows the attacker to potentially gain control of the user's account.

Recommendations Update Masa CMS to version 7.2.8 or later. Update Masa CMS to version 7.3.13 or later. Update Masa CMS to version 7.4.6 or later.

Exploit

Fix

Origin Validation Error

Weakness Enumeration

CWE-640

CWE-346

Related Identifiers

CVE-2024-32642

GHSA-QJM6-C8HX-FFH8

Affected Products

Masacms

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32642.json · Exploit
• https://github.com/MasaCMS/MasaCMS/commit/7541b9c99fb9e32d1de6f2658750525cec1d8960 · Patch
• https://github.com/MasaCMS/MasaCMS/security/advisories/GHSA-qjm6-c8hx-ffh8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-32642 · Security Note
• https://osv.dev/vulnerability/CVE-2024-32642 · Vendor Advisory
• https://twitter.com/cracbot/status/1997984568264315020 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1996336663006523652 · Twitter Post
• https://twitter.com/CVEnew/status/1996268278054883841 · Twitter Post
• https://twitter.com/CveFindCom/status/1996273083670319557 · Twitter Post
• https://t.me/cveNotify/144892 · Telegram Post