CVE-2022-25568 MotionEye allows attackers to access sensitive information
Attackers can access sensitive configuration data via an unauthenticated GET request if the regular user password is not configured.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-25568?
CVE-2022-25568 is a high-severity vulnerability in n/a, published on 24 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. To exploit this vulnerability, a regular user password must be unconfigured.
Weakness: CWE-1188
Which versions are affected by CVE-2022-25568?
3 open source packages ship an affected version, including motioneye. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
motioneye PyPI | All versions | 0.43.1b1 |
motioneye PyPI | All versions | 0.43.1b1 |
motioneye PyPI | All versions | 0.43.1b1 |
Products include Motioneye Project Motioneye.
How do I fix CVE-2022-25568?
Upgrade motioneye to 0.43.1b1 or later.
Is CVE-2022-25568 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-25568 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in n/a
Sources
Also known as GHSA-2c7w-v459-cwgf, PYSEC-2022-43141.