Vulnerability Report

CVE-2021-35484

Title: Time-based Blind SQL Injection in Nokia IMPACT

SQLi

Proof Of Concept

No public PoC currently indexed for CVE-2021-35484.

CWE Category NVD-CWE-noinfo

Published Date Mar 03, 2026

Modified Date Mar 05, 2026

Exploit Status Not Found

Score 8.2 CVSS v

Exploit Probability (EPSS)

0.03%

Vulnerability Summary

CVE-2021-35484: Nokia IMPACT through 19.11.2.10-20210118042150283 allows an authenticated user to perform a Time-based Boolean Blind SQL Injection attack on the endpoint /ui/rest-proxy/campaign/statistic (for the View Campaign page) via the sortColumn HTTP GET parameter. This allows an attacker to access sensitive data from the database and obtain access to the database user, database name, and database version information.

Impacted Vendors

nokia 1

sound4 1

Reference Links

https://www.gruppotim.it/it/footer/red-team/2021/Motive-Impact-CVE-2021-35484.html https://www.nokia.com/networks/solutions/impact-iot-platform/ https://www.nokia.com/notices/responsible-disclosure/

CVSS v3.1

Source Entity 134c704f-9b21-4f2e-91b3-4a467353bcc0

Severity HIGH

8.2

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns