CVE-2023-31044 Details
Description
An issue was discovered in Nokia Impact before Mobile 23_FP1. In Impact DM 19.11 onwards, a remote authenticated user, using the Add Campaign functionality, can inject a malicious payload within the Campaign Name. This data can be exported to a CSV file. Attackers can populate data fields that may attempt data exfiltration or other malicious activity when automatically executed by the spreadsheet software.
A vulnerability allowing for improper neutralization of formula elements in CSV exports has been identified in Nokia Impact versions prior to Mobile 23_FP1. This issue arises in Impact DM 19.11 and later, where a remote authenticated user can inject malicious payloads into the Campaign Name while using the Add Campaign feature. The injected data can be exported to a CSV file, potentially leading to data exfiltration or other malicious activities when the file is opened with spreadsheet software.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://nokia.com | [email protected] | Product |
| https://www.gruppotim.it/it/footer/red-team/2023/Motive-Impact-CVE-2023-31044.html | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| nokia impact mobile | >= 19.11, <= 23 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 9, 2026 | Initial Analysis | [email protected] |
| Mar 4, 2026 | CVE Modified | CISA-ADP |
| Mar 3, 2026 | New CVE Received | [email protected] |