{"action":"Upgrade motioneye to 0.43.1b1 or later.","affected":[{"fixed":"0.43.1b1","introduced":"0"}],"component":"motioneye","cve_ids":["CVE-2022-25568"],"ecosystem":"PyPI","epss":0.06885,"exploited":false,"fixed_versions":["0.43.1b1"],"ghsa_id":"GHSA-2c7w-v459-cwgf","id":"tcs_01M5KGHREHEB2JYMNBD82A6VYV","modified_at":"2026-06-10T17:02:23.300380642Z","published_at":"2022-03-24T17:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2022-43141","https://www.pizzapower.me/2022/02/17/motioneye-config-info-disclosure/","https://github.com/ccrisan/motioneye/issues/2292","https://github.com/advisories/GHSA-2c7w-v459-cwgf"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"PYSEC-2022-43141","url":"https://osv.dev/vulnerability/PYSEC-2022-43141"}],"summary":"MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. To exploit this vulnerability, a regular user password must be unconfigured."}