Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:NSummary
CVE-2021-35484 is a high-severity SQL Injection (CWE-89) vulnerability in Nokia Impact. Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 15th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-2 (Flaw Remediation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2021-35484 is a Time-based Boolean Blind SQL Injection vulnerability (CWE-89) affecting Nokia IMPACT through version 19.11.2.10-20210118042150283. The issue resides in the /ui/rest-proxy/campaign/statistic endpoint, used for the View Campaign page, where the sortColumn HTTP GET parameter fails to properly sanitize input, enabling SQL injection attacks. The vulnerability has a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), highlighting high confidentiality impact with network accessibility and low attack complexity.
An authenticated user can exploit this vulnerability remotely by crafting malicious sortColumn parameter values to conduct time-based blind SQL injection. Successful exploitation allows extraction of sensitive data from the database, including the database user credentials, database name, and database version information.
Advisories and additional details are available from Gruppo TIM at https://www.gruppotim.it/it/footer/red-team/2021/Motive-Impact-CVE-2021-35484.html, Nokia's IMPACT IoT platform page at https://www.nokia.com/networks/solutions/impact-iot-platform/, and Nokia's responsible disclosure notice at https://www.nokia.com/notices/responsible-disclosure/. Practitioners should consult these for patch information and mitigation guidance.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-22126
Vulnerability Data
Nokia IMPACT through 19.11.2.10-20210118042150283 allows an authenticated user to perform a Time-based Boolean Blind SQL Injection attack on the endpoint /ui/rest-proxy/campaign/statistic (for the View Campaign page) via the sortColumn HTTP GET parameter. This allows an attacker to access sensitive data…
more
from the database and obtain access to the database user, database name, and database version information.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public web endpoint directly enables remote exploitation of the application (T1190) and extraction of data from backend databases (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
SI-10 mandates validation of HTTP GET parameters like sortColumn to block time-based blind SQL injection and prevent extraction of sensitive database information.
SI-9 enforces restrictions and sanitization on inputs such as the sortColumn parameter, directly mitigating SQL injection vulnerabilities in the /ui/rest-proxy/campaign/statistic endpoint.
SI-2 requires timely remediation of identified flaws like CVE-2021-35484 through patching or code fixes to eliminate the SQL injection vulnerability.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly target injection flaws during coding and review so largely prevent CWE-89 introduction, yet the single broad outcome leaves residual risk from incomplete neutralization techniques or missed edge cases.
Training raises developer awareness of SQLi risks and can reduce introduction likelihood (partial) but removes none of the actual coding flaw's risk by itself since technical neutralization is still required.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
The same secure-coding and static-analysis activities surface missing neutralization of SQL metacharacters before the system is accepted.
Early warnings and shared best-practice information help organizations apply the latest remediation techniques against SQL-injection vulnerabilities.
Threat-intelligence feeds that surface new SQL-injection campaigns enable rapid updates to query-construction defenses and detection signatures before exploitation occurs.
Secure-coding rules and security testing phases mandate the use of parameterized queries or equivalent escaping, preventing the construction of dynamic SQL statements from untrusted input.
Language-specific secure coding rules, peer review and SAST together prevent the construction of SQL statements from untrusted data without proper parameterization or escaping.