PT-2022-6443 · Nokia · Nokia Netact

Aleksandr Ustinov + 1 · Published 2022-10-10 · Updated 2025-02-04 · CVE-2023-26059

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nokia NetAct versions prior to 22 SP1037

Description An issue was discovered in the Site Configuration Tool tab of Nokia NetAct, where attackers can upload a ZIP file that, when processed, exploits Stored XSS. The upload option of the Site Configuration tool does not validate the file contents. The application is in a demilitarised zone behind a perimeter firewall and without exposure to the internet. The attack can only be performed by an internal user.

Recommendations For versions prior to 22 SP1037, update to version 22 SP1037 or later to resolve the issue. As a temporary workaround, consider disabling the file upload option in the Site Configuration Tool tab until a patch is available. Restrict access to the Site Configuration Tool to minimize the risk of exploitation. Avoid using the upload option for ZIP files in the affected tool until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-01305

CVE-2023-26059

Affected Products

Nokia Netact

References · 7

• https://bdu.fstec.ru/vul/2023-01305 · Security Note
• https://osv.dev/vulnerability/CVE-2023-26059 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26059 · Security Note
• https://nokia.com · Note
• https://t.me/cvenotify/109913 · Telegram Post
• https://ptsecurity.com/ww-en/analytics/threatscape/pt-2022-03 · Note
• https://t.me/cibsecurity/62754 · Telegram Post