CVE-2022-47002

CRITICAL NUCLEI

Masa CMS <7.4 - Auth Bypass

Title source: llm

CVE-2022-47002 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

A vulnerability in the Remember Me function of Masa CMS v7.2, 7.3, and 7.4-beta allows attackers to bypass authentication via a crafted web request.

Masa CMS - Authentication Bypass

CRITICALVERIFIEDby iamnoooob,rootxharsh,pdresearch

Shodan: Generator: Masa CMS || generator: masa cms

Core 3

Core References

Release Notes, Third Party Advisory

Third Party Advisory

Exploit, Third Party Advisory

CVSS v3 9.8

EPSS 0.0625

EPSS Percentile 92.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-863

Status published

Products (2)

masacms/masacms 7.4.0 alpha1 (4 CPE variants)

masacms/masacms < 7.2.5

Published Feb 01, 2023

Tracked Since Feb 18, 2026