← Vulnerability feed

Vulnerability record · CVE-2024-32642 · published 3 December 2025

CVE-2024-32642: Masacms origin validation error vulnerability

MMasacms · Masacms

Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, there is vulnerable to host header poisoning which allows account takeover via password reset email. This vulnerability is fixed in 7.2.8, 7.3.13, and 7.4.6.

8.8 CVSS 3.1 High EPSS 0.20% · top 91.1% CWE-346 · Origin validation errorCWE-640 · Weak password recovery
8.8CVSS 3.1 base score
0.20%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 1 tagged exploit
26 Sep 2026Last modified by NVD

Description

Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, there is vulnerable to host header poisoning which allows account takeover via password reset email. This vulnerability is fixed in 7.2.8, 7.3.13, and 7.4.6.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/MasaCMS/MasaCMS/commit/7541b9c99fb9e32d1de6f2658750525cec1d8960 Patch
https://github.com/MasaCMS/MasaCMS/security/advisories/GHSA-qjm6-c8hx-ffh8 ExploitVendor Advisory

Track CVE-2024-32642 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2024-32641Masacms code injection vulnerabilityMasa CMS is an open source Enterprise Content Management platform. Masa CMS versions prior to 7.2.8, 7.3.13, and 7.4.6 are vulnerable to remote code …EPSS 12%9.8CVE-2022-47002Masacms incorrect authorization vulnerabilityA vulnerability in the Remember Me function of Masa CMS v7.2, 7.3, and 7.4-beta allows attackers to bypass authentication via a crafted web request.EPSS 6.3%7.5CVE-2024-32643Masacms incorrect authorization vulnerabilityMasa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, if the URL to the page is modified to include a…EPSS 0.36%7.5CVE-2021-42183Masacms path traversal vulnerabilityMasaCMS 7.2.1 is affected by a path traversal vulnerability in /index.cfm/_api/asset/image/.EPSS 4.7%6.1CVE-2025-66492Masacms cross-site scripting vulnerabilityMasa CMS is an open source Enterprise Content Management platform. Versions 7.2.8 and below, 7.3.1 through 7.3.13, 7.4.0-alpha.1 through 7.4.8 and 7.…EPSS 0.25%9.4CVE-2025-34291Langflow CORS misconfiguration leads to token theft and RCELangflow up to and including 1.6.9 ships an overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) and a refresh token …KEVEPSS 93%analysed8.8CVE-2015-4495Firefox PDF reader same-origin bypass allows file read and privilege gainThe PDF reader in Mozilla Firefox (before 39.0.3), Firefox ESR 38.x (before 38.1.1), and Firefox OS (before 2.2) fails to properly validate origin, l…KEVEPSS 69%analysed

Source: NIST National Vulnerability Database (record CVE-2024-32642), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.