PT-2026-22759 · Nokia · Nokia Impact

CVE-2021-35484 · Publicado 2026-03-03 · Atualizado 2026-03-03

Positive Technologies (AI Summary)

CVSS v3.1

8.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nokia IMPACT versions through 19.11.2.10-20210118042150283

Description An authenticated user can perform a Time-based Boolean Blind SQL Injection attack. The attack targets the /ui/rest-proxy/campaign/statistic API endpoint via the sortColumn HTTP GET parameter. Successful exploitation allows an attacker to access sensitive data from the database, including the database user, database name, and database version information.

Recommendations Versions prior to 19.11.2.10-20210118042150283 should be updated. Restrict access to the /ui/rest-proxy/campaign/statistic endpoint. Avoid using the sortColumn parameter in the affected API endpoint until the issue is resolved.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2021-35484

Produtos afetados

Nokia Impact

Referências · 8

• https://twitter.com/infoflowcloud/status/2028902172159607076 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2021-35484 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2021-35484 · Aviso do Fabricante
• https://t.me/CVEtracker/46225 · Publicação no Telegram
• https://nokia.com/networks/solutions/impact-iot-platform · Nota
• https://gruppotim.it/it/footer/red-team/2021/Motive-Impact-CVE-2021-35484.html · Nota
• https://twitter.com/CVEnew/status/2028900646657691739 · Publicação no Twitter
• https://nokia.com/notices/responsible-disclosure · Nota