CVE-2021-44255

Advisory

MotionEye 0.42.1 and prior are affected by CVE-2021-44255: Authenticated remote code execution in MotionEye<= 0.42.1 and MotioneEyeOS <= 20200606 allows a remote attacker to upload a configuration backup file containing a malicious python pickle file which will execute arbitrary code on the server.
https://github.com/ccrisan/motioneyeos/issues/2843

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Authenticated remote code execution in MotionEye <= 0.42.1 and MotioneEyeOS <= 20200606 allows a remote attacker to upload a configuration backup file containing a malicious python pickle file which will execute arbitrary code on the server. See CVE-2021-44255.


MISC:https://github.com/ccrisan/motioneyeos/issues/2843: https://github.com/ccrisan/motioneyeos/issues/2843
MISC:https://www.pizzapower.me/2021/10/09/self-hosted-security-part-1-motioneye/: https://www.pizzapower.me/2021/10/09/self-hosted-security-part-1-motioneye/

Resources

• https://github.com/ccrisan/motioneyeos/issues/2843
• https://www.pizzapower.me/2021/10/09/self-hosted-security-part-1-motioneye/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44255