CVE-2024-32642

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-32642", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-04-16T14:15:26.874Z", "datePublished": "2025-12-03T16:37:53.409Z", "dateUpdated": "2025-12-03T16:50:44.007Z"}, "containers": {"cna": {"title": "Host header poisoning allows account takeover via password reset email", "problemTypes": [{"descriptions": [{"cweId": "CWE-346", "lang": "en", "description": "CWE-346: Origin Validation Error", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-640", "lang": "en", "description": "CWE-640: Weak Password Recovery Mechanism for Forgotten Password", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/MasaCMS/MasaCMS/security/advisories/GHSA-qjm6-c8hx-ffh8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/MasaCMS/MasaCMS/security/advisories/GHSA-qjm6-c8hx-ffh8"}, {"name": "https://github.com/MasaCMS/MasaCMS/commit/7541b9c99fb9e32d1de6f2658750525cec1d8960", "tags": ["x_refsource_MISC"], "url": "https://github.com/MasaCMS/MasaCMS/commit/7541b9c99fb9e32d1de6f2658750525cec1d8960"}], "affected": [{"vendor": "MasaCMS", "product": "MasaCMS", "versions": [{"version": ">= 7.4.0, < 7.4.6", "status": "affected"}, {"version": ">= 7.3.0, < 7.3.13", "status": "affected"}, {"version": "< 7.2.8", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-12-03T16:37:53.409Z"}, "descriptions": [{"lang": "en", "value": "Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, there is vulnerable to host header poisoning which allows account takeover via password reset email. This vulnerability is fixed in 7.2.8, 7.3.13, and 7.4.6."}], "source": {"advisory": "GHSA-qjm6-c8hx-ffh8", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-03T16:50:28.932386Z", "id": "CVE-2024-32642", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-03T16:50:44.007Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-32642", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-03T16:50:28.932386Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-03T16:50:34.121Z"}}], "cna": {"title": "Host header poisoning allows account takeover via password reset email", "source": {"advisory": "GHSA-qjm6-c8hx-ffh8", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "MasaCMS", "product": "MasaCMS", "versions": [{"status": "affected", "version": ">= 7.4.0, < 7.4.6"}, {"status": "affected", "version": ">= 7.3.0, < 7.3.13"}, {"status": "affected", "version": "< 7.2.8"}]}], "references": [{"url": "https://github.com/MasaCMS/MasaCMS/security/advisories/GHSA-qjm6-c8hx-ffh8", "name": "https://github.com/MasaCMS/MasaCMS/security/advisories/GHSA-qjm6-c8hx-ffh8", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/MasaCMS/MasaCMS/commit/7541b9c99fb9e32d1de6f2658750525cec1d8960", "name": "https://github.com/MasaCMS/MasaCMS/commit/7541b9c99fb9e32d1de6f2658750525cec1d8960", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, there is vulnerable to host header poisoning which allows account takeover via password reset email. This vulnerability is fixed in 7.2.8, 7.3.13, and 7.4.6."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-346", "description": "CWE-346: Origin Validation Error"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-640", "description": "CWE-640: Weak Password Recovery Mechanism for Forgotten Password"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-12-03T16:37:53.409Z"}}}, "cveMetadata": {"cveId": "CVE-2024-32642", "state": "PUBLISHED", "dateUpdated": "2025-12-03T16:50:44.007Z", "dateReserved": "2024-04-16T14:15:26.874Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-12-03T16:37:53.409Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "MasaCMS", "vendor": "MasaCMS", "versions": [{"status": "affected", "version": ">= 7.4.0, < 7.4.6"}, {"status": "affected", "version": ">= 7.3.0, < 7.3.13"}, {"status": "affected", "version": "< 7.2.8"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:masacms:masacms:*:*:*:*:*:*:*:*", "matchCriteriaId": "82A74C33-3407-498A-9444-4A451E5968FE", "versionEndExcluding": "7.2.8", "vulnerable": true}, {"criteria": "cpe:2.3:a:masacms:masacms:*:*:*:*:*:*:*:*", "matchCriteriaId": "45C4FA2D-DCEF-4991-B21D-C2BAC3A9DF5C", "versionEndExcluding": "7.3.13", "versionStartIncluding": "7.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:masacms:masacms:*:*:*:*:*:*:*:*", "matchCriteriaId": "ED61DA62-94D4-4081-923F-2674CFC7945A", "versionEndExcluding": "7.4.6", "versionStartIncluding": "7.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, there is vulnerable to host header poisoning which allows account takeover via password reset email. This vulnerability is fixed in 7.2.8, 7.3.13, and 7.4.6."}, {"lang": "es", "value": "Masa CMS es una plataforma de gesti\u00f3n de contenido empresarial de c\u00f3digo abierto. Versiones anteriores a 7.2.8, 7.3.13 y 7.4.6 son vulnerables a envenenamiento de encabezado de host que permite la toma de control de cuentas a trav\u00e9s de correo electr\u00f3nico de restablecimiento de contrase\u00f1a. Esta vulnerabilidad est\u00e1 corregida en 7.2.8, 7.3.13 y 7.4.6."}], "id": "CVE-2024-32642", "lastModified": "2026-09-26T21:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-32642", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-03T16:50:28.932386Z", "version": "2.0.3"}}]}, "published": "2025-12-03T17:15:48.543", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/MasaCMS/MasaCMS/commit/7541b9c99fb9e32d1de6f2658750525cec1d8960"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/MasaCMS/MasaCMS/security/advisories/GHSA-qjm6-c8hx-ffh8"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-346"}, {"lang": "en", "value": "CWE-640"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-12-04T16:44:31.059871+00:00", "updated": "2025-12-04T16:44:31.059898+00:00", "vendors": ["masacms", "masacms$PRODUCT$masacms"]}