CVE-2021-35487

Nokia Broadcast Message Center through 11.1.0 allows an authenticated user to perform a Boolean Blind SQL Injection attack on the endpoint /owui/block/send-receive-updates (for the Manage Alerts page) via the extIdentifier HTTP POST parameter. This allows an attacker to obtain the database user, database name, and database version information, and potentially database data.

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0

4.0 MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N

EPSS

1.01% chance of exploitation in the next 30 days, 61th percentile

Published

2022-05-25

Updated

2024-08-04

Proof-of-concept exploits (1)

• https://www.gruppotim.it/it/footer/red-team.html

References

• CVE Record
• NVD entry

Related

• CVE-2021-35479
• CVE-2021-35488
• CVE-2021-35478
• CVE-2021-35492
• CVE-2021-35475
• CVE-2021-35501