CVE-2021-35483
MEDIUMCVSS Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Lifecycle Timeline
2Description
The Applications component of Nokia IMPACT version through 19.11.2.10-20210118042150283 allows an authenticated user to arbitrarily upload JavaScript files via the /ui/rest-proxy/application fileupload parameter. This can occur during the adding of a new application, or during the editing of an existing one. If an authenticated user visits the web page where the file is published, the JavaScript code is executed.
Analysis
Impact versions up to 19.11.2.10-20210118042150283 is affected by cross-site scripting (xss) (CVSS 4.1).
Technical Context
This vulnerability (CWE-79: Cross-site Scripting (XSS)) affects Impact. The Applications component of Nokia IMPACT version through 19.11.2.10-20210118042150283 allows an authenticated user to arbitrarily upload JavaScript files via the /ui/rest-proxy/application fileupload parameter. This can occur during the adding of a new application, or during the editing of an existing one. If an authenticated user visits the web page where the file is published, the JavaScript code is executed.
Affected Products
Vendor: Nokia. Product: Impact. Versions: up to 19.11.2.10-20210118042150283.
Remediation
Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today