What is the CVSS score of CVE-2021-35484?

CVE-2021-35484 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Impact are affected by CVE-2021-35484?

Nokia IMPACT users face a critical SQL injection vulnerability that allows authenticated attackers to extract sensitive campaign data without detection.

How to fix or mitigate CVE-2021-35484?

Within 24 hours: Disable or restrict access to the /ui/rest-proxy/campaign/statistic endpoint via WAF rules and network controls. Within 7 days: Audit access logs for suspicious sortColumn parameter activity and implement strict input validation. Within 30 days: Contact Nokia for patch availability, plan upgrade path to patched version, and enforce principle of least privilege for campaign statistic access.

Impact CVE-2021-35484

HIGH

SQL Injection (CWE-89)

2026-03-03 cve@mitre.org

SQLi Impact

8.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:05 vuln.today

CVE Published

Mar 03, 2026 - 18:16 nvd

HIGH 8.2

DescriptionCVE.org

Nokia IMPACT through 19.11.2.10-20210118042150283 allows an authenticated user to perform a Time-based Boolean Blind SQL Injection attack on the endpoint /ui/rest-proxy/campaign/statistic (for the View Campaign page) via the sortColumn HTTP GET parameter. This allows an attacker to access sensitive data from the database and obtain access to the database user, database name, and database version information.

AnalysisAI

Technical ContextAI

Classified as CWE-89 (SQL Injection). Affects the sortColumn HTTP GET component of Impact. Nokia IMPACT through 19.11.2.10-20210118042150283 allows an authenticated user to perform a Time-based Boolean Blind SQL Injection attack on the endpoint /ui/rest-proxy/campaign/statistic (for the View Campaign page) via the sortColumn HTTP GET parameter. This allows an attacker to access sensitive data from the database and obtain access to the database user, database name, and database version information.

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.