CVEvulnerability

CVE-2021-35486

8.1 HIGH Published 2026-03-03 Modified 2026-06-17 Official page ↗

Status: Analyzed
Published: 2026-03-03
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 8.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Weaknesses: CWE-352

Description

A Cross-Site Request Forgery (CSRF) vulnerability in Nokia IMPACT through 19.11.2.10-20210118042150283 allows a remote attacker to import and overwrite the entire application configuration. Specifically, in /ui/rest-proxy/entity/import, neither the X-CSRF-NONCE HTTP header nor the CSRF-NONCE cookie is validated.

Affected configurations

• nokia impact mobile (<= 19.11.2.10-20210118042150283)

Weakness · CWE (1)

CWE-352 Cross-Site Request Forgery weakness

References

https://www.gruppotim.it/it/footer/red-team/2021/Motive-Impact-CVE-2021-35486.html Third Party Advisory
https://www.nokia.com/networks/solutions/impact-iot-platform/ Product
https://www.nokia.com/notices/responsible-disclosure/ Vendor Advisory

CVE-2021-35486

Description

Affected configurations

Related

Weakness · CWE (1)

References