PT-2026-22758 · Nokia · Nokia Impact

Published 2026-03-03 · Updated 2026-03-03 · CVE-2021-35483

Positive Technologies (AI Summary)

CVSS v3.1

4.1

Medium

Base vector

AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nokia IMPACT versions through 19.11.2.10-20210118042150283

Description The Applications component of Nokia IMPACT allows an authenticated user to upload JavaScript files without restriction via the /ui/rest-proxy/application fileupload parameter. This can happen when adding a new application or editing an existing one. If an authenticated user accesses the web page where the file is published, the JavaScript code will be executed.

Recommendations Versions prior to 19.11.2.10-20210118042150283 should be updated. Restrict file uploads to the /ui/rest-proxy/application endpoint.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-35483

Affected Products

Nokia Impact

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2021-35483 · Security Note
• https://osv.dev/vulnerability/CVE-2021-35483 · Vendor Advisory
• https://gruppotim.it/it/footer/red-team/2021/Motive-Impact-CVE-2021-35483.html · Note
• https://twitter.com/CVEnew/status/2028900645676167409 · Twitter Post
• https://nokia.com/notices/responsible-disclosure · Note
• https://t.me/CVEtracker/46224 · Telegram Post
• https://nokia.com/networks/solutions/impact-iot-platform · Note
• https://twitter.com/infoflowcloud/status/2028902155050967249 · Twitter Post