Motioneye · Motioneye · CVE-2022-25568
**Name of the Vulnerable Software and Affected Versions**
MotionEye versions 0.42.1 and below
**Description**
The issue allows attackers to access sensitive information via a GET request to "/config/list". To exploit this, a regular user password must be unconfigured.
**Recommendations**
For MotionEye versions 0.42.1 and below, as a temporary workaround, consider restricting access to the "/config/list" endpoint until a patch is available. Avoid using unconfigured regular user passwords in the affected setup to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.