CVE-2024-32642: Host header poisoning allows account takeover via password reset email
Published Dec 3, 2025
·Updated
Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, there is vulnerable to host header poisoning which allows account takeover via password reset email. This vulnerability is fixed in 7.2.8, 7.3.13, and 7.4.6.
Affected Software
4 affected components
MASA CMS<7.2.8, <7.3.13, <7.4.6
MasaCMS MasaCMS<7.2.8
MasaCMS MasaCMS>=7.3<7.3.13
MasaCMS MasaCMS>=7.4.0<7.4.6
Remediation
Event History
Dec 3, 2025
CVE Published
via MITRE·04:37 PM
Data Sourced
via MITRE·04:37 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-32642?
CVE-2024-32642 has a high severity level due to its potential for account takeover through host header poisoning.
2
How do I fix CVE-2024-32642?
To fix CVE-2024-32642, upgrade to Masa CMS version 7.2.8, 7.3.13, or 7.4.6.
3
Who is affected by CVE-2024-32642?
CVE-2024-32642 affects Masa CMS versions prior to 7.2.8, 7.3.13, and 7.4.6.
4
What type of vulnerability is CVE-2024-32642?
CVE-2024-32642 is categorized as a host header poisoning vulnerability.
5
What consequences can occur from CVE-2024-32642?
Exploitation of CVE-2024-32642 can lead to unauthorized account access through compromised password reset mechanisms.