CVE-2021-35484
Plain English Summary
AI-powered analysis for quick understanding
This vulnerability allows an authenticated user to exploit a flaw in the Nokia IMPACT system to extract sensitive information from the database, such as user credentials and database details, by manipulating a specific web request. To take advantage of this, the attacker must already have access to the system as a logged-in user.
Technical Description
Nokia IMPACT through 19.11.2.10-20210118042150283 allows an authenticated user to perform a Time-based Boolean Blind SQL Injection attack on the endpoint /ui/rest-proxy/campaign/statistic (for the View Campaign page) via the sortColumn HTTP GET parameter. This allows an attacker to access sensitive data from the database and obtain access to the database user, database name, and database version information.
CVSS Vector Analysis
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:NExploit Resources
Search for proof-of-concept code and exploit modules
Official References
Quick Information
Published
Mar 3, 2026
about 1 month ago
Last Modified
Mar 5, 2026
about 1 month ago
Vendor
nokia
Product
impact
Related Vulnerabilities
This vulnerability allows an attacker, who is already authenticated as a user, to inject harmful code into the Campaign Name field, which can then be exported to a CSV file. When this file is opened in spreadsheet software, it may automatically execute the malicious code, potentially leading to data theft or other harmful actions.
This vulnerability allows an attacker with valid login credentials to upload malicious executable files to the server, which could lead to unauthorized control over the system. It can be exploited when adding or editing applications within the Nokia IMPACT platform.
This vulnerability allows an attacker, who is already logged into the Nokia IMPACT system, to upload malicious JavaScript files that can be executed when other users visit the affected web page. The attacker can exploit this during the process of adding or editing applications, potentially leading to unauthorized actions on behalf of those users.