Nokia IMPACT through 19.11.2.10-20210118042150283 allows an authenticated user to perform a Time-based Boolean Blind SQL Injection attack on the endpoint /ui/rest-proxy/campaign/statistic (for the View Campaign page) via the sortColumn HTTP GET parameter. This allows an attacker to access sensitive data from the database and obtain access to the database user, database name, and database version information.
References
| Link | Resource |
|---|---|
| https://www.gruppotim.it/it/footer/red-team/2021/Motive-Impact-CVE-2021-35484.html | Third Party Advisory |
| https://www.nokia.com/networks/solutions/impact-iot-platform/ | Product |
| https://www.nokia.com/notices/responsible-disclosure/ | Issue Tracking |
Configurations
History
05 Mar 2026, 21:53
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Nokia impact
Nokia |
|
| References | () https://www.gruppotim.it/it/footer/red-team/2021/Motive-Impact-CVE-2021-35484.html - Third Party Advisory | |
| References | () https://www.nokia.com/networks/solutions/impact-iot-platform/ - Product | |
| References | () https://www.nokia.com/notices/responsible-disclosure/ - Issue Tracking | |
| CPE | cpe:2.3:a:nokia:impact:*:*:*:*:*:*:*:* |
04 Mar 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-89 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.2 |
03 Mar 2026, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-03 18:16
Updated : 2026-03-05 21:53
NVD link : CVE-2021-35484
Mitre link : CVE-2021-35484
CVE.ORG link : CVE-2021-35484
JSON object : View
Products Affected
nokia
- impact
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')