Quick answers
- Is CVE-2024-57041 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2024-57041 being exploited in the wild.
- How severe is CVE-2024-57041?
- Low severity, with a CVSS score of 3.1, published 24 January 2025.
- Which products and versions are affected?
- NodeBB 0 to 3.11.0.
- Is there a fix for CVE-2024-57041?
- A patch was published on 2025-01-24: Fix released in version 3.11.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2024-57041 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2024-57041?
- Check whether you run NodeBB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A persistent cross-site scripting (XSS) vulnerability exists in NodeBB v3.11.0 in the user profile "about me" section (CWE-79). The vulnerable component fails to properly escape user-supplied input before rendering it on the page, allowing an authenticated attacker to inject arbitrary JavaScript code. The injected payload is stored in the database and executes in the browser of any user who visits the attacker's profile. An attacker must have a NodeBB account to exploit this, but no special privileges are required. The attack is fixed in version 3.11.1 via input escaping.
Affected products
- NodeBB NodeBB 0 to 3.11.0
Identifiers
- CVE-2024-57041
- GHSA-vqr3-vrrg-f3jh
Timeline
- 2025-01-24: disclosed
- 2025-01-24: patched: Fix released in version 3.11.1