CVE-2021-35483

Published: Mar 3, 2026Modified: Jun 17, 2026

4.1

Vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Exploitability: 1.5 / Impact: 2.5

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The Applications component of Nokia IMPACT version through 19.11.2.10-20210118042150283 allows an authenticated user to arbitrarily upload JavaScript files via the /ui/rest-proxy/application fileupload parameter. This can occur during the adding of a new application, or during the editing of an existing one. If an authenticated user visits the web page where the file is published, the JavaScript code is executed.

Affected (1)

Products: Nokia: Impact

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Nokia Impact	Up to 19.11.2.10-20210118042150283

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (3)

https://www.gruppotim.it/it/footer/red-team/2021/Motive-Impact-CVE-2021-35483.html

Source: cve@mitre.org

Third Party Advisory

https://www.nokia.com/networks/solutions/impact-iot-platform/

Source: cve@mitre.org

Product

https://www.nokia.com/notices/responsible-disclosure/

Source: cve@mitre.org

Issue Tracking

Timeline

No history available yet.