CVE-2021-35485
Plain English Summary
AI-powered analysis for quick understanding
This vulnerability allows an attacker with valid login credentials to upload malicious executable files to the server, which could lead to unauthorized control over the system. It can be exploited when adding or editing applications within the Nokia IMPACT platform.
Technical Description
The Applications component of Nokia IMPACT version through 19.11.2.10-20210118042150283 allows an authenticated user to arbitrarily upload server-side executable files via the /ui/rest-proxy/application fileupload parameter. This can occur during the adding of a new application, or during the editing of an existing one.
CVSS Vector Analysis
Vector String
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploit Resources
Search for proof-of-concept code and exploit modules
Official References
Quick Information
Published
Mar 3, 2026
about 1 month ago
Last Modified
Mar 5, 2026
about 1 month ago
Vendor
nokia
Product
impact
Related Vulnerabilities
This vulnerability allows an attacker, who is already authenticated as a user, to inject harmful code into the Campaign Name field, which can then be exported to a CSV file. When this file is opened in spreadsheet software, it may automatically execute the malicious code, potentially leading to data theft or other harmful actions.
This vulnerability allows an authenticated user to exploit a flaw in the Nokia IMPACT system to extract sensitive information from the database, such as user credentials and database details, by manipulating a specific web request. To take advantage of this, the attacker must already have access to the system as a logged-in user.
This vulnerability allows an attacker, who is already logged into the Nokia IMPACT system, to upload malicious JavaScript files that can be executed when other users visit the affected web page. The attacker can exploit this during the process of adding or editing applications, potentially leading to unauthorized actions on behalf of those users.