CVE-2024-32641

critical · 9.8

Masa CMS is an open source Enterprise Content Management platform. Masa CMS versions prior to 7.2.8, 7.3.13, and 7.4.6 are vulnerable to remote code execution. The vulnerability exists in the addParam function, which accepts user input via the criteria parameter. This input is subsequently evaluated by setDynamicContent, allowing an unauthenticated attacker to execute arbitrary code via the m tag. The vulnerability is patched in versions 7.2.8, 7.3.13, and 7.4.6.

9.8

CVSS

12.3%

EPSS (exploit prob.)

96th

EPSS percentile

2025-12-03

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-94

Affected products

Vendor	Product	Affected versions
masacms	masacms	< 7.2.8
masacms	masacms	>= 7.3, < 7.3.13
masacms	masacms	>= 7.4.0, < 7.4.6

Check a specific version with /api/v1/cve/match.

References

https://github.com/MasaCMS/MasaCMS/commit/fb27f822fe426496af71205fa35208e58823fcf6
https://github.com/MasaCMS/MasaCMS/security/advisories/GHSA-cj9g-v5mq-qrjm

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-32641