CVE-2021-35487: SQL Injection
Nokia Broadcast Message Center through 11.1.0 allows an authenticated user to perform a Boolean Blind SQL Injection attack on the endpoint /owui/block/send-receive-updates (for the Manage Alerts page) via the extIdentifier HTTP POST parameter. This allows an attacker to obtain the database user, database name, and database version information, and potentially database data.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-35487?
The severity of CVE-2021-35487 is medium.
How can an authenticated user exploit CVE-2021-35487?
An authenticated user can exploit CVE-2021-35487 by performing a Boolean Blind SQL Injection attack on the endpoint /owui/block/send-receive-updates via the extIdentifier HTTP POST parameter.
What can an attacker obtain by exploiting CVE-2021-35487?
By exploiting CVE-2021-35487, an attacker can obtain the database user and data.
What is the affected software for CVE-2021-35487?
The affected software for CVE-2021-35487 is Nokia Broadcast Message Center up to and including version 11.1.0.
Is there any additional information available for CVE-2021-35487?
Yes, additional information can be found at the following references: [1] and [2].