PT-2022-12031 · Unknown+1 · Motioneyeos+1

Pizza Power · Published 2022-01-31 · Updated 2022-07-12 · CVE-2021-44255

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MotionEye versions 0.42.1 and earlier MotionEyeOS versions 20200606 and earlier

Description The issue allows a remote attacker to upload a configuration backup file containing a malicious python pickle file, which will execute arbitrary code on the server. This can occur when an installation is accessible over the Internet and uses no or poor authentication credentials.

Recommendations For MotionEye versions 0.42.1 and earlier, consider keeping the installation off the Internet and use strong credentials to provide protection against this issue. For MotionEyeOS versions 20200606 and earlier, consider keeping the installation off the Internet and use strong credentials to provide protection against this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Unrestricted File Upload

Weakness Enumeration

CWE-306

CWE-434

Related Identifiers

CVE-2021-44255

GHSA-M2C7-42RF-C62F

Affected Products

Motioneye

Motioneyeos

References · 7

• https://osv.dev/vulnerability/GHSA-m2c7-42rf-c62f · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-44255 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44255 · Security Note
• https://github.com/ccrisan/motioneyeos/issues/2843 · Note
• https://github.com/ccrisan/motioneye · Note
• https://t.me/cibsecurity/36575 · Telegram Post
• https://pizzapower.me/2021/10/09/self-hosted-security-part-1-motioneye · Note