PT-2026-22761 · Nokia · Nokia Impact

CVE-2021-35486 · Publicado 2026-03-03 · Atualizado 2026-03-13

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Nokia IMPACT versions through 19.11.2.10-20210118042150283

Description A Cross-Site Request Forgery (CSRF) issue exists in Nokia IMPACT. This allows a remote attacker to import and overwrite the entire application configuration. The issue is due to a lack of validation for the X-CSRF-NONCE HTTP header and the CSRF-NONCE cookie in the /ui/rest-proxy/entity/import API endpoint.

Recommendations Versions prior to 19.11.2.10-20210118042150283 should be updated.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2021-35486

Produtos afetados

Nokia Impact

Referências · 9

• https://gruppotim.it/it/footer/red-team/2021/Motive-Impact-CVE-2021-35486.html · Nota
• https://t.me/cveNotify/155377 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2028900648851263754 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2021-35486 · Aviso do Fabricante
• https://nokia.com/networks/solutions/impact-iot-platform · Nota
• https://t.me/CVEtracker/46227 · Publicação no Telegram
• https://twitter.com/infoflowcloud/status/2028902204799594860 · Publicação no Twitter
• https://nokia.com/notices/responsible-disclosure · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2021-35486 · Nota de Segurança