Nokia Impact vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Nokia Impact: 3 record(s), with affected versions and fixes.
cpe:2.3:a:nokia:impact

CVE-2021-35485 High · 8.0 CWE-434 Mar 3, 2026

Unrestricted Upload of File with Dangerous Type in Nokia Impact

The Applications component of Nokia IMPACT version through 19.11.2.10-20210118042150283 allows an authenticated user to arbitrarily upload server-side executable files via the /ui/rest-proxy/application fileupload parameter. This can occur during the adding of a new application, or during the editing of an existing one.

CVE-2021-35484 High · 8.2 CWE-89 Mar 3, 2026

SQL Injection in Nokia Impact

Nokia IMPACT through 19.11.2.10-20210118042150283 allows an authenticated user to perform a Time-based Boolean Blind SQL Injection attack on the endpoint /ui/rest-proxy/campaign/statistic (for the View Campaign page) via the sortColumn HTTP GET parameter. This allows an attacker to access sensitive data from the database and obtain access to the database user, database name, and database version information.

CVE-2021-35483 Medium · 4.1 CWE-79 Mar 3, 2026

Cross-site Scripting (XSS) in Nokia Impact

The Applications component of Nokia IMPACT version through 19.11.2.10-20210118042150283 allows an authenticated user to arbitrarily upload JavaScript files via the /ui/rest-proxy/application fileupload parameter. This can occur during the adding of a new application, or during the editing of an existing one. If an authenticated user visits the web page where the file is published, the JavaScript code is executed.