CVE-2024-32641
CriticalSummary
Masa CMS before versions 7.2.8, 7.3.13, and 7.4.6 is vulnerable to remote code execution. The vulnerability exists in the addParam function, which accepts user input via the criteria parameter, subsequently evaluated by setDynamicContent, allowing an unauthenticated attacker to execute arbitrary code via the m tag.
Risk Assessment
An unauthenticated attacker can execute arbitrary code on the server, potentially leading to full compromise of the CMS and its data.
Recommendation
Update Masa CMS to version 7.2.8, 7.3.13, or 7.4.6 (or later). Restrict access to the administrative panel.
Original NVD description (English source)
Masa CMS is an open source Enterprise Content Management platform. Masa CMS versions prior to 7.2.8, 7.3.13, and 7.4.6 are vulnerable to remote code execution. The vulnerability exists in the addParam function, which accepts user input via the criteria parameter. This input is subsequently evaluated by setDynamicContent, allowing an unauthenticated attacker to execute arbitrary code via the m tag. The vulnerability is patched in versions 7.2.8, 7.3.13, and 7.4.6.