Esa Jokinen

**Name of the Vulnerable Software and Affected Versions** cve-search (affected versions not specified) **Description** An unauthenticated improper input validation issue exists in the 'POST /fetch cve data' endpoint. A remote attacker can manipulate request parameters that control the MongoDB collection, projected fields, and regular-expression filters to read arbitrary application MongoDB collections. This flaw can expose administrative usernames and password hashes from the `mgmt users` collection, which may lead to offline password cracking and the compromise of administrative accounts. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.