Lucene search

MitreCVE-2021-35487

HistoryMay 25, 2022 - 2:15 p.m.

CVE-2021-35487

2022-05-2514:15:08

CWE-89

mitre

web.nvd.nist.gov

cve-2021

sql injection

nokia broadcast message center

nvd

authentication

boolean blind sql injection

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.7

Confidence

High

EPSS

0.001

Percentile

32.8%

JSON

Nokia Broadcast Message Center through 11.1.0 allows an authenticated user to perform a Boolean Blind SQL Injection attack on the endpoint /owui/block/send-receive-updates (for the Manage Alerts page) via the extIdentifier HTTP POST parameter. This allows an attacker to obtain the database user, database name, and database version information, and potentially database data.

Affected configurations

Nvd

Node

nokiabroadcast_message_centerRange≤11.1.0

VendorProductVersionCPE
nokiabroadcast_message_center*cpe:2.3:a:nokia:broadcast_message_center:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
nokia	broadcast_message_center	*	cpe:2.3:a:nokia:broadcast_message_center::::::::

References

www.gruppotim.it/it/footer/red-team.html

www.nokia.com/notices/responsible-disclosure/

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.7

Confidence

High

EPSS

0.001

Percentile

32.8%

JSON

Related for CVE-2021-35487