CVE-2020-8887: SQL Injection
Telestream Tektronix Medius before 10.7.5 and Sentry before 10.7.5 have a SQL injection vulnerability allowing an unauthenticated attacker to dump database contents via the page parameter in a page=login request to index.php (aka the server login page).
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this SQL injection vulnerability in Telestream Tektronix Medius and Sentry?
The vulnerability ID for this SQL injection vulnerability is CVE-2020-8887.
What is the severity of CVE-2020-8887?
The severity of CVE-2020-8887 is high.
How can an attacker exploit CVE-2020-8887?
An unauthenticated attacker can exploit CVE-2020-8887 by using the page parameter in a page=login request to index.php (the server login page) to dump database contents.
Which versions of Telestream Tektronix Medius and Sentry are affected by CVE-2020-8887?
Telestream Tektronix Medius versions up to exclusive 10.7.5 and Sentry versions up to exclusive 10.7.5 are affected by CVE-2020-8887.
Is there a fix available for CVE-2020-8887?
Yes, upgrading to version 10.7.5 or later of Telestream Tektronix Medius and Sentry will fix the SQL injection vulnerability (CVE-2020-8887).