OnCommand Insight versions through 7.3.6 may disclose sensitive account information to an authenticated user.

Source