by Kastro
Paper/Archive/CVE-2024-32641

CVE-2024-32641

MasaCMS MasaCMS — Masa CMS Vulnerable to Pre-Auth RCE via JSON API

EPSS 12%public exploitCVSS 9.8
critical.is priorityof 100
59
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 96.2.962 × 2019.2Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Masa CMS is an open source Enterprise Content Management platform. Masa CMS versions prior to 7.2.8, 7.3.13, and 7.4.6 are vulnerable to remote code execution. The vulnerability exists in the addParam function, which accepts user input via the criteria parameter. This input is subsequently evaluated by setDynamicContent, allowing an unauthenticated attacker to execute arbitrary code via the m tag. The vulnerability is patched in versions 7.2.8, 7.3.13, and 7.4.6.

Affected

ProductAffectedFixed inSource
MasaCMS>= 7.4.0, < 7.4.6–CNA
MasaCMS>= 7.3.0, < 7.3.13–CNA
MasaCMS< 7.2.8–CNA

Scores by source

GitHub_M (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refgithub.com/MasaCMS/MasaCMS/security/advisories/GHSA-cj9g-v5mq-qrjmrefgithub.com/MasaCMS/MasaCMS/commit/fb27f822fe426496af71205fa35208e58823fcf6