Wiz
Vulnerability DatabaseCVE-2021-42183

CVE-2021-42183: 
MasaCMS vulnerability analysis and mitigation

Overview

MasaCMS 7.2.1 contains a path traversal vulnerability in the /index.cfm/_api/asset/image/ endpoint. The vulnerability was discovered in 2021 and assigned identifier CVE-2021-42183 (CVE Details, MITRE).

Technical details

The vulnerability exists in the file handling functionality of MasaCMS, specifically in the /index.cfm/_api/asset/image/ endpoint. The issue allows attackers to traverse directory paths using the filePath parameter. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 HIGH (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) (NVD).

Impact

The vulnerability allows unauthorized access to files outside the intended directory structure. An attacker can potentially read sensitive configuration files and system information through path traversal, including accessing the Application.cfc file and configuration settings (GitHub POC).

Mitigation and workarounds

The vulnerability affects MasaCMS version 7.2.1. Users should upgrade to a patched version of the software. The issue was identified in the fileManager.cfc component (MasaCMS Source).

Additional resources

Source: This report was generated using AI

Related MasaCMS vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

CVE-2024-32641CRITICAL9.8
  • MasaCMSMasaCMS
  • cpe:2.3:a:masacms:masacms
NoYesDec 03, 2025
CVE-2024-32640CRITICAL9.8
  • MasaCMSMasaCMS
  • cpe:2.3:a:masacms:masacms
NoYesAug 11, 2025
CVE-2022-47002CRITICAL9.8
  • MasaCMSMasaCMS
  • cpe:2.3:a:masacms:masacms
NoYesFeb 01, 2023
CVE-2024-32642HIGH8.8
  • MasaCMSMasaCMS
  • cpe:2.3:a:masacms:masacms
NoYesDec 03, 2025
CVE-2024-32643HIGH7.5
  • MasaCMSMasaCMS
  • cpe:2.3:a:masacms:masacms
NoYesDec 03, 2025

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Additional Wiz resources

Cloud Vulnerability DB

Cloud Vulnerability DB

A community-led vulnerabilities database

Cloud Threat Landscape

Cloud Threat Landscape

A threat intelligence database

PEACH

PEACH

A tenant isolation framework

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management
Get a demo