What’s Vulnerable › Vulnerabilities

CVE-2016-10533

• Severity: high (CVSS 8.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-05-31 · updated 2026-06-17
• Weakness: CWE-200

Description

express-restify-mongoose is a module to easily create a flexible REST interface for mongoose models. express-restify-mongoose 2.4.2 and earlier and 3.0.X through 3.0.1 allows a malicious user to send a request for `GET /User?distinct=password` and get all the passwords for all the users in the database, despite the field being set to private. This can be used for other private data if the malicious user knew what was set as private for specific routes.

Affected products

• HackerOne express-restify-mongoose node module: through 2.4.2; from 3.0.0 through 3.0.1

References

• https://github.com/florianholzapfel/express-restify-mongoose/issues/252
• https://nodesecurity.io/advisories/92
• https://github.com/florianholzapfel/express-restify-mongoose/issues/252
• https://nodesecurity.io/advisories/92

Get alerted when CVE-2016-10533 or the next vulnerability affects your stack