File Upload Vulnerability in Nokia NetAct Products
CVE-2021-26596

5.4MEDIUM

Key Information:

Vendor
Nokia
Status
Netact
Vendor
CVE Published:
25 March 2021

Summary

A vulnerability exists in Nokia NetAct 18A that allows a malicious user to manipulate the filename of an uploaded file to incorporate JavaScript code. This code is subsequently stored and executed in the web browser of a victim, posing significant security risks. Attackers may exploit this vulnerability by embedding malicious JavaScript in a URL, which can then be shared publicly or sent directly to targets. The specific parameter associated with this vulnerability is /netact/sct, making it crucial for users of NetAct to implement the necessary security measures to prevent unauthorized file uploads.

References

https://www.gruppotim.it/redteam
x_refsource_MISC
https://www.trusted-introducer.org/directory/teams/nokia-...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.