SQL Injection Vulnerability in Nokia IMPACT Platform

CVE-2021-35484

What is CVE-2021-35484?

The Nokia IMPACT platform, through version 19.11.2.10-20210118042150283, is susceptible to a Time-based Boolean Blind SQL Injection attack. An authenticated user can exploit this vulnerability by manipulating the sortColumn HTTP GET parameter on the endpoint /ui/rest-proxy/campaign/statistic. This exploitation facilitates unauthorized access to sensitive database information, including user credentials, database names, and version details, thereby posing a significant security risk. Organizations utilizing the IMPACT platform should implement necessary security patches and validate inputs to mitigate such vulnerabilities.

References