PT-2026-22758 · Nokia · Nokia Impact

Publicado 2026-03-03 · Atualizado 2026-03-03 · CVE-2021-35483

Positive Technologies (AI Summary)

CVSS v3.1

4.1

Média

Vetor base

AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nokia IMPACT versions through 19.11.2.10-20210118042150283

Description The Applications component of Nokia IMPACT allows an authenticated user to upload JavaScript files without restriction via the /ui/rest-proxy/application fileupload parameter. This can happen when adding a new application or editing an existing one. If an authenticated user accesses the web page where the file is published, the JavaScript code will be executed.

Recommendations Versions prior to 19.11.2.10-20210118042150283 should be updated. Restrict file uploads to the /ui/rest-proxy/application endpoint.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2021-35483

Produtos afetados

Nokia Impact

Referências · 8

• https://nvd.nist.gov/vuln/detail/CVE-2021-35483 · Nota de Segurança
• https://gruppotim.it/it/footer/red-team/2021/Motive-Impact-CVE-2021-35483.html · Nota
• https://twitter.com/CVEnew/status/2028900645676167409 · Publicação no Twitter
• https://nokia.com/notices/responsible-disclosure · Nota
• https://t.me/CVEtracker/46224 · Publicação no Telegram
• https://nokia.com/networks/solutions/impact-iot-platform · Nota
• https://twitter.com/infoflowcloud/status/2028902155050967249 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2021-35483 · Aviso do Fabricante