The Applications component of Nokia IMPACT version through 19.11.2.10-20210118042150283 allows an authenticated user to arbitrarily upload JavaScript files via the /ui/rest-proxy/application fileupload parameter. This can occur during the adding of a new application, or during the editing of an existing one. If an authenticated user visits the web page where the file is published, the JavaScript code is executed.
References
| Link | Resource |
|---|---|
| https://www.gruppotim.it/it/footer/red-team/2021/Motive-Impact-CVE-2021-35483.html | Third Party Advisory |
| https://www.nokia.com/networks/solutions/impact-iot-platform/ | Product |
| https://www.nokia.com/notices/responsible-disclosure/ | Issue Tracking |
Configurations
History
05 Mar 2026, 21:50
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.gruppotim.it/it/footer/red-team/2021/Motive-Impact-CVE-2021-35483.html - Third Party Advisory | |
| References | () https://www.nokia.com/networks/solutions/impact-iot-platform/ - Product | |
| References | () https://www.nokia.com/notices/responsible-disclosure/ - Issue Tracking | |
| First Time |
Nokia impact
Nokia |
|
| CPE | cpe:2.3:a:nokia:impact:*:*:*:*:*:*:*:* |
04 Mar 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-79 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.1 |
03 Mar 2026, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-03 18:16
Updated : 2026-03-05 21:50
NVD link : CVE-2021-35483
Mitre link : CVE-2021-35483
CVE.ORG link : CVE-2021-35483
JSON object : View
Products Affected
nokia
- impact
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')