CyberRota Analysis
AI-GeneratedAn unauthenticated input validation vulnerability in the POST /fetch_cve_data endpoint of cve-search affects MongoDB, allowing remote attackers to manipulate request parameters and access arbitrary collections. This can lead to the exposure of sensitive information, including administrative usernames and password hashes, which may facilitate offline password cracking and compromise of administrative accounts. Organizations using MongoDB should prioritize remediation to protect against potential unauthorized access and data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
An unauthenticated improper input validation vulnerability in the POST /fetch_cve_data endpoint in cve-search. A remote attacker can manipulate request parameters controlling the MongoDB collection, projected fields, and regular-expression filters to read arbitrary application MongoDB collections. This can expose administrative usernames and password hashes from the mgmt_users collection, enabling offline password cracking and potential administrative account compromise.