PT-2026-22759 · Nokia · Nokia Impact

Published 2026-03-03 · Updated 2026-03-03 · CVE-2021-35484

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nokia IMPACT versions through 19.11.2.10-20210118042150283

Description An authenticated user can perform a Time-based Boolean Blind SQL Injection attack. The attack targets the /ui/rest-proxy/campaign/statistic API endpoint via the sortColumn HTTP GET parameter. Successful exploitation allows an attacker to access sensitive data from the database, including the database user, database name, and database version information.

Recommendations Versions prior to 19.11.2.10-20210118042150283 should be updated. Restrict access to the /ui/rest-proxy/campaign/statistic endpoint. Avoid using the sortColumn parameter in the affected API endpoint until the issue is resolved.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-35484

Affected Products

Nokia Impact

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2021-35484 · Security Note
• https://osv.dev/vulnerability/CVE-2021-35484 · Vendor Advisory
• https://twitter.com/infoflowcloud/status/2028902172159607076 · Twitter Post
• https://t.me/CVEtracker/46225 · Telegram Post
• https://nokia.com/networks/solutions/impact-iot-platform · Note
• https://gruppotim.it/it/footer/red-team/2021/Motive-Impact-CVE-2021-35484.html · Note
• https://twitter.com/CVEnew/status/2028900646657691739 · Twitter Post
• https://nokia.com/notices/responsible-disclosure · Note