Nokia Impact vulnerabilities

7 vulnerabilities

Known vulnerabilities in Nokia Impact, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

8.2CVE-2021-35484nokiaimpact
EPSS score
0.24%
Nokia IMPACT through 19.11.2.10-20210118042150283 allows an authenticated user to perform a Time-based Boolean Blind SQL Injection attack on the endpoint /ui/rest-proxy/campaign/statistic (for the View Campaign page) via the sortColumn HTTP GET parameter. This allows an attacker to access sensitive data from the database and obtain access to the database user, database name, and database version information.4.1CVE-2021-35483nokiaimpact
EPSS score
0.23%
The Applications component of Nokia IMPACT version through 19.11.2.10-20210118042150283 allows an authenticated user to arbitrarily upload JavaScript files via the /ui/rest-proxy/application fileupload parameter. This can occur during the adding of a new application, or during the editing of an existing one. If an authenticated user visits the web page where the file is published, the JavaScript code is executed.8CVE-2021-35485nokiaimpact
EPSS score
0.24%
The Applications component of Nokia IMPACT version through 19.11.2.10-20210118042150283 allows an authenticated user to arbitrarily upload server-side executable files via the /ui/rest-proxy/application fileupload parameter. This can occur during the adding of a new application, or during the editing of an existing one.4.3CVE-2019-17404nokiaimpact
EPSS score
0.97%
Nokia IMPACT < 18A: allows full path disclosure8.8CVE-2019-17403nokiaimpact
EPSS score
2.54%
Nokia IMPACT < 18A: An unrestricted File Upload vulnerability was found that may lead to Remote Code Execution.5.3CVE-2019-17406nokiaimpact
EPSS score
1.12%
Nokia IMPACT < 18A has path traversal that may lead to RCE if chained with CVE-2019-17436.1CVE-2019-17405nokiaimpact
EPSS score
0.71%
Nokia IMPACT < 18A: has Reflected self XSS