What is the CVSS score of CVE-2021-35485?

CVE-2021-35485 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Impact are affected by CVE-2021-35485?

Systems running affected versions (up to 19.11.2.10-20210118042150283) are vulnerable to unrestricted file uploads that could allow attackers to execute arbitrary code and compromise system…

How to fix or mitigate CVE-2021-35485?

Within 24 hours: Identify and inventory all systems running affected versions and restrict network access to these systems where operationally feasible. Within 7 days: Implement compensating controls (WAF rules, input validation enforcement, disable file upload functionality if non-critical). Within 30 days: Develop and execute an upgrade plan to move to patched versions once available, coordinate with vendor for security updates, and establish a continuous monitoring program for exploitation attempts.

Impact CVE-2021-35485

HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-03-03 cve@mitre.org

File Upload Impact

8.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.0 HIGH

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:05 vuln.today

CVE Published

Mar 03, 2026 - 18:16 nvd

HIGH 8.0

DescriptionCVE.org

The Applications component of Nokia IMPACT version through 19.11.2.10-20210118042150283 allows an authenticated user to arbitrarily upload server-side executable files via the /ui/rest-proxy/application fileupload parameter. This can occur during the adding of a new application, or during the editing of an existing one.

AnalysisAI

Impact versions up to 19.11.2.10-20210118042150283 is affected by unrestricted upload of file with dangerous type (CVSS 8.0).

Technical ContextAI

This vulnerability (CWE-434: Unrestricted Upload of File with Dangerous Type) affects Impact. The Applications component of Nokia IMPACT version through 19.11.2.10-20210118042150283 allows an authenticated user to arbitrarily upload server-side executable files via the /ui/rest-proxy/application fileupload parameter. This can occur during the adding of a new application, or during the editing of an existing one.