High severity8.8NVD Advisory· Published May 31, 2018· Updated Jun 17, 2026
CVE-2016-10533
CVE-2016-10533
Description
express-restify-mongoose is a module to easily create a flexible REST interface for mongoose models. express-restify-mongoose 2.4.2 and earlier and 3.0.X through 3.0.1 allows a malicious user to send a request for GET /User?distinct=password and get all the passwords for all the users in the database, despite the field being set to private. This can be used for other private data if the malicious user knew what was set as private for specific routes.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
express-restify-mongoosenpm | >= 3.0.0, < 3.1.0 | 3.1.0 |
express-restify-mongoosenpm | < 2.5.0 | 2.5.0 |
Affected products
2- HackerOne/express-restify-mongoose node modulev5Range: <= 2.4.2 || >= 3.0.0 <=3.0.1
Patches
Vulnerability mechanics
References
8- nodesecurity.io/advisories/92nvdExploitThird Party Advisory
- github.com/advisories/GHSA-cgjx-mwpx-47jvghsaADVISORY
- github.com/florianholzapfel/express-restify-mongoose/issues/252nvdIssue TrackingThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2016-10533ghsaADVISORY
- github.com/florianholzapfel/express-restify-mongoose/commit/23ccb247d0074bfaca6737cdff52d89c6d6e4a7cghsaWEB
- github.com/florianholzapfel/express-restify-mongoose/commit/746defcd808e2ed1e8931dc36702b25b7db0e94bghsaWEB
- github.com/florianholzapfel/express-restify-mongoose/pull/253ghsaWEB
- www.npmjs.com/advisories/92ghsaWEB
News mentions
0No linked articles in our index yet.