CVE-2024-32641 - CVE House
Back to Database
Status published Critical CVE-2024-32641

Masa CMS Vulnerable to Pre-Auth RCE via JSON API

Vulnerability Description

Masa CMS is an open source Enterprise Content Management platform. Masa CMS versions prior to 7.2.8, 7.3.13, and 7.4.6 are vulnerable to remote code execution. The vulnerability exists in the addParam function, which accepts user input via the criteria parameter. This input is subsequently evaluated by setDynamicContent, allowing an unauthenticated attacker to execute arbitrary code via the m tag. The vulnerability is patched in versions 7.2.8, 7.3.13, and 7.4.6.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-32641

Credits & Attribution

No credits recorded in the NVD database.

References

More from MasaCMS

View All →
CVE-2025-66492
Masa CMS vulnerable to Cross-Site Scripting (XSS) through URL Parameter
High 8.2
CVE-2024-32643
Masa CMS vulnerable to authentication bypass with /tag/
High 7.5
CVE-2024-32642
Host header poisoning allows account takeover via password reset email
High 8.8
CVE-2024-32640
MasaCMS SQL Injection vulnerability
Critical 9.8

Affected Vendor

Affected Software

MasaCMS
Vulnerable Versions:
>= 7.4.0, < 7.4.6, >= 7.3.0, < 7.3.13, < 7.2.8

Timeline

Official Publish: December 3rd, 2025
Last Modified: December 3rd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-94

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1505.003 Web Shell
Persistence
T1105 Ingress Tool Transfer
Command and Control
T1565.002 Stored Data Manipulation
Impact