CVE-2021-35484
Published: 03 March 2026
Summary
CVE-2021-35484 is a high-severity SQL Injection (CWE-89) vulnerability in Nokia Impact. Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 14.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2021-35484 is a Time-based Boolean Blind SQL Injection vulnerability (CWE-89) affecting Nokia IMPACT through version 19.11.2.10-20210118042150283. The issue resides in the /ui/rest-proxy/campaign/statistic endpoint, used for the View Campaign page, where the sortColumn HTTP GET parameter fails to properly sanitize input, enabling SQL injection attacks. The vulnerability has a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), highlighting high confidentiality impact with network accessibility and low attack complexity.
An authenticated user can exploit this vulnerability remotely by crafting malicious sortColumn parameter values to conduct time-based blind SQL injection. Successful exploitation allows extraction of sensitive data from the database, including the database user credentials, database name, and database version information.
Advisories and additional details are available from Gruppo TIM at https://www.gruppotim.it/it/footer/red-team/2021/Motive-Impact-CVE-2021-35484.html, Nokia's IMPACT IoT platform page at https://www.nokia.com/networks/solutions/impact-iot-platform/, and Nokia's responsible disclosure notice at https://www.nokia.com/notices/responsible-disclosure/. Practitioners should consult these for patch information and mitigation guidance.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-22126
Vulnerability details
Nokia IMPACT through 19.11.2.10-20210118042150283 allows an authenticated user to perform a Time-based Boolean Blind SQL Injection attack on the endpoint /ui/rest-proxy/campaign/statistic (for the View Campaign page) via the sortColumn HTTP GET parameter. This allows an attacker to access sensitive data…
more
from the database and obtain access to the database user, database name, and database version information.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public web endpoint directly enables remote exploitation of the application (T1190) and extraction of data from backend databases (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 mandates validation of HTTP GET parameters like sortColumn to block time-based blind SQL injection and prevent extraction of sensitive database information.
SI-9 enforces restrictions and sanitization on inputs such as the sortColumn parameter, directly mitigating SQL injection vulnerabilities in the /ui/rest-proxy/campaign/statistic endpoint.
SI-2 requires timely remediation of identified flaws like CVE-2021-35484 through patching or code fixes to eliminate the SQL injection vulnerability.