id: PYSEC-2022-43141
modified: 2024-11-21T14:22:55.422153Z
published: 2022-03-24T17:15:00Z
aliases:
- CVE-2022-25568
- GHSA-2c7w-v459-cwgf
details: MotionEye v0.42.1 and below allows attackers to access sensitive information
  via a GET request to /config/list. To exploit this vulnerability, a regular user
  password must be unconfigured.
affected:
- package:
    ecosystem: PyPI
    name: motioneye
    purl: pkg:pypi/motioneye
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 0.43.1b1
  versions:
  - "0.27"
  - 0.27.1
  - 0.27.2
  - "0.28"
  - 0.28.1
  - 0.28.2
  - 0.28.3
  - "0.29"
  - 0.29.1
  - 0.29rc1
  - 0.29rc2
  - "0.30"
  - 0.30rc1
  - 0.30rc2
  - "0.31"
  - 0.31.1
  - 0.31.2
  - 0.31.3
  - 0.31.4
  - 0.31.5
  - "0.32"
  - 0.32.1
  - 0.32.2
  - "0.33"
  - 0.33.1
  - 0.33.2
  - 0.33.3
  - 0.33.4
  - "0.34"
  - 0.34.1
  - 0.34rc1
  - "0.35"
  - 0.35.1
  - 0.35.2
  - 0.35rc1
  - "0.36"
  - 0.36.1
  - "0.37"
  - 0.37.1
  - 0.37rc1
  - "0.38"
  - 0.38.1
  - "0.39"
  - 0.39.1
  - 0.39.2
  - 0.39.3
  - "0.40"
  - 0.40rc1
  - 0.40rc2
  - 0.40rc3
  - 0.40rc4
  - 0.40rc5
  - "0.41"
  - 0.41rc1
  - "0.42"
  - 0.42.1
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
references:
- type: EVIDENCE
  url: https://www.pizzapower.me/2022/02/17/motioneye-config-info-disclosure/
- type: WEB
  url: https://www.pizzapower.me/2022/02/17/motioneye-config-info-disclosure/
- type: REPORT
  url: https://github.com/ccrisan/motioneye/issues/2292
- type: ADVISORY
  url: https://github.com/advisories/GHSA-2c7w-v459-cwgf