PT-2022-17371 · Motioneye · Motioneye

Pizza Power · Published 2022-03-24 · Updated 2023-08-08 · CVE-2022-25568

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions MotionEye versions 0.42.1 and below

Description The issue allows attackers to access sensitive information via a GET request to "/config/list". To exploit this, a regular user password must be unconfigured.

Recommendations For MotionEye versions 0.42.1 and below, as a temporary workaround, consider restricting access to the "/config/list" endpoint until a patch is available. Avoid using unconfigured regular user passwords in the affected setup to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-200

CWE-1188

Related Identifiers

CVE-2022-25568

GHSA-2C7W-V459-CWGF

PYSEC-2022-43141

Affected Products

Motioneye

References · 10

• 🔥 https://pizzapower.me/2022/02/17/motioneye-config-info-disclosure · Exploit
• https://osv.dev/vulnerability/PYSEC-2022-43141 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-25568 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25568 · Security Note
• https://osv.dev/vulnerability/GHSA-2c7w-v459-cwgf · Vendor Advisory
• https://github.com/ccrisan/motioneye/issues/2292 · Note
• https://github.com/motioneye-project/motioneye · Note
• https://github.com/motioneye-project/motioneye/commit/c60b64af5bb8c09189071522a1f6796cb44340b0 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/motioneye/PYSEC-2022-43141.yaml · Note
• https://t.me/cibsecurity/39502 · Telegram Post