Moderate severityNVD Advisory· Published Jan 24, 2025· Updated Feb 6, 2025

CVE-2024-57041

Description

A persistent cross-site scripting (XSS) vulnerability in NodeBB v3.11.0 allows remote attackers to store arbitrary code in the 'about me' section of their profile.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
nodebbnpm	< 3.11.1	3.11.1

Affected products

NodeBB/Nodebbcpe-rescue
ghsa-coords
pkg:npm/nodebb
Range: < 3.11.1

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-vqr3-vrrg-f3jhghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2024-57041ghsaADVISORY
github.com/NodeBB/NodeBB/commit/4e69bff72fd04779064d37e46a43080e6c328adfghsaWEB
www.tonysec.com/posts/cve-2024-57041ghsaWEB
nodebb.commitre
www.tonysec.com/posts/cve-2024-57041/mitre

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.021
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000