MotionEye allows attackers to access sensitive information

HIGH 7.5CVE-2022-25568 · GHSA-2c7w-v459-cwgf · PYSEC-2022-43141 · Published 24/03/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
motioneye PyPI	`< 0.43.1b1`	`0.43.1b1`
motioneye motioneye_project	`≤ 0.42.1`	No fix yet

Description

MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. To exploit this vulnerability, a regular user password must be unconfigured.

NVD description

MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. To exploit this vulnerability, a regular user password must be unconfigured.

References

nvd.nist.gov/vuln/detail/CVE-2022-25568 · ADVISORY
ccrisan/motioneye · WEB
motioneye-project/motioneye commit c60b64a · WEB
motioneye-project/motioneye · PACKAGE
pypa/advisory-database · WEB
pizzapower.me/2022/02/17/motioneye-config-info-disclosure · WEB
pizzapower.me/2022/02/17/motioneye-config-info-disclosure · Exploit
GitHub Advisory GHSA-2c7w-v459-cwgf · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free