How serious is CVE-2023-31044?

This vulnerability has a CVSS score of 8.8 out of 10, classified as HIGH severity. Proof-of-concept exploit code is publicly available, making this an active threat.

Is there exploit code available for CVE-2023-31044?

Yes, proof-of-concept exploit code for CVE-2023-31044 is publicly available on GitHub and security research platforms. This increases the risk of active exploitation.

Which products are affected by CVE-2023-31044?

CVE-2023-31044 affects nokia impact mobile. Check the full CVE details for specific version information.

How do I fix CVE-2023-31044?

To remediate CVE-2023-31044, check for security patches from nokia. Apply all available updates and security patches. If no patch is available, implement recommended workarounds or security controls to mitigate the risk.

CVE-2023-31044

High

|8.8

Exploit Available

Plain English Summary

AI-powered analysis for quick understanding

This vulnerability allows an attacker, who is already authenticated as a user, to inject harmful code into the Campaign Name field, which can then be exported to a CSV file. When this file is opened in spreadsheet software, it may automatically execute the malicious code, potentially leading to data theft or other harmful actions.

Technical Description

An issue was discovered in Nokia Impact before Mobile 23_FP1. In Impact DM 19.11 onwards, a remote authenticated user, using the Add Campaign functionality, can inject a malicious payload within the Campaign Name. This data can be exported to a CSV file. Attackers can populate data fields that may attempt data exfiltration or other malicious activity when automatically executed by the spreadsheet software.

CVSS Vector Analysis

Attack VectorNetwork

Attack ComplexityLow

Privileges RequiredLow

User InteractionNone

Confidentiality ImpactHigh

Integrity ImpactHigh

Availability ImpactHigh

ScopeUnchanged

Vector String

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploit Resources

Search for proof-of-concept code and exploit modules

GitHub Search Exploit-DB Nuclei Templates Metasploit Vulners

Official References

NIST NVD

Est. Bounty

$4,789($1K-$5K)

Vendor Response

Grade APatched in 5 days

Quick Information

Published

Mar 3, 2026

about 1 month ago

Last Modified

Mar 9, 2026

29 days ago

Vendor

nokia

Product

impact mobile

Related Vulnerabilities

CVE-2021-35485High

This vulnerability allows an attacker with valid login credentials to upload malicious executable files to the server, which could lead to unauthorized control over the system. It can be exploited when adding or editing applications within the Nokia IMPACT platform.

CVE-2021-35484High

This vulnerability allows an authenticated user to exploit a flaw in the Nokia IMPACT system to extract sensitive information from the database, such as user credentials and database details, by manipulating a specific web request. To take advantage of this, the attacker must already have access to the system as a logged-in user.

CVE-2021-35483Medium

This vulnerability allows an attacker, who is already logged into the Nokia IMPACT system, to upload malicious JavaScript files that can be executed when other users visit the affected web page. The attacker can exploit this during the process of adding or editing applications, potentially leading to unauthorized actions on behalf of those users.