PT-2018-4712 · Npm · Express-Restify-Mongoose

Smirea · Published 2018-05-31 · Updated 2019-10-09 · CVE-2016-10533

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions express-restify-mongoose versions 2.4.2 and earlier express-restify-mongoose versions 3.0.0 through 3.0.1

Description The issue allows a malicious user to send a request for "GET /User?distinct=password" and get all the passwords for all the users in the database, despite the field being set to private. This can be used for other private data if the malicious user knew what was set as private for specific routes. A malicious user can exploit this to access fields on a model even if those fields are marked as private.

Recommendations For express-restify-mongoose version 2.x: Update to version 2.5.0 or later. For express-restify-mongoose version 3.x: Update to version 3.1.0 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2016-10533

GHSA-CGJX-MWPX-47JV

Affected Products

Express-Restify-Mongoose

References · 10

• 🔥 https://nodesecurity.io/advisories/92 · Exploit
• https://osv.dev/vulnerability/CVE-2016-10533 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cgjx-mwpx-47jv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-10533 · Security Note
• https://github.com/florianholzapfel/express-restify-mongoose/issues/252 · Note
• https://github.com/florianholzapfel/express-restify-mongoose/commit/23ccb247d0074bfaca6737cdff52d89c6d6e4a7c · Note
• https://github.com/florianholzapfel/express-restify-mongoose/pull/253 · Note
• https://github.com/florianholzapfel/express-restify-mongoose/commit/746defcd808e2ed1e8931dc36702b25b7db0e94b · Note
• https://github.com/advisories/GHSA-cgjx-mwpx-47jv · Note
• https://npmjs.com/advisories/92 · Note