CVE-2021-35486 - Vulnerability Analysis

Overview

Nokia IMPACT through 19.11.2.10-20210118042150283 contains a cross site request forgery caused by lack of validation of X-CSRF-NONCE header and CSRF-NONCE cookie in /ui/rest-proxy/entity/import, letting remote attackers import and overwrite application configuration, exploit requires victim interaction.

Severity & Score

Impact

Remote attackers can overwrite the entire application configuration, potentially disrupting service or causing denial of service.

Mitigation

Update to the latest version that validates CSRF tokens properly.

References

• https://www.gruppotim.it/it/footer/red-team/2021/Motive-Impact-CVE-2021-35486.html
• https://www.nokia.com/networks/solutions/impact-iot-platform/
• https://www.nokia.com/notices/responsible-disclosure/

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner