Information Disclosure Vulnerability in MotionEye by MotionEye
CVE-2022-25568

7.5HIGH

Key Information:

Vendor

Motioneye Project

Status
Motioneye
Vendor
CVE Published:
24 March 2022

What is CVE-2022-25568?

MotionEye versions up to 0.42.1 are vulnerable to an information disclosure issue that allows unprivileged users to access sensitive configuration data through a simple GET request to /config/list. This weakness occurs when the user password is not configured, exposing configuration details that should be safeguarded against unauthorized access. Proper security measures should be put in place to prevent exploitation.

References

https://www.pizzapower.me/2022/02/17/motioneye-config-inf...
x_refsource_MISC
https://github.com/ccrisan/motioneye/issues/2292
x_refsource_MISC

EPSS Score

89% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2022-25568 : Information Disclosure Vulnerability in MotionEye by MotionEye