CVE-2023-31044
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedAn issue was discovered in Nokia Impact before Mobile 23_FP1. In Impact DM 19.11 onwards, a remote authenticated user, using the Add Campaign functionality, can inject a malicious payload within the Campaign Name. This data can be exported to a CSV file. Attackers can populate data fields that may attempt data exfiltration or other malicious activity when automatically executed by the spreadsheet software.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceA CSV injection vulnerability in Nokia Impact Device Manager's Add Campaign functionality allows authenticated users to inject malicious spreadsheet formulas (e.g., =CMD|' /C calc'!A0) into the Campaign Name field. When exported to CSV and opened in spreadsheet software like Excel, these formulas can execute arbitrary commands or enable data exfiltration.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data>= 19.11, <= 23CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify installed Nokia Impact versionAccess the Nokia Impact administration console or check system information to determine the exact version number of the Nokia Impact Mobile platformAffected if The installed version is >= 19.11 and <= 23 (any version within this range is potentially affected)
-
Verify user role access to Campaign managementCheck user permissions and role assignments in the Nokia Impact user management interface to determine if the Add Campaign functionality is accessibleAffected if Any authenticated user role has access to create campaigns, as the vulnerability can be exploited by any authenticated remote user
-
Inspect Campaign Name input handlingAttempt to create a test campaign using the Add Campaign feature and input a formula-like string containing special characters (=, +, -, @) in the Campaign Name field to observe whether input validation is appliedAffected if Special characters like =, +, -, @, or tab characters are accepted without sanitization or rejection in the Campaign Name field
-
Verify CSV export functionalityLocate the CSV export option for campaign data in the Nokia Impact interface and export campaign data to confirm that Campaign Name fields are included in the outputAffected if The CSV export feature exists and includes Campaign Name data in the exported file without proper CSV escaping (e.g., no preceding single quote or double quote wrapping)
-
Confirm CSV injection payload executionOpen the exported CSV file in a spreadsheet application to verify whether embedded formulas in the Campaign Name field are interpreted and potentially executedAffected if Formulas injected into Campaign Name field execute or attempt to execute when the exported CSV is opened in spreadsheet software
Your environment is affected if you run Nokia Impact Mobile version 19.11 through 23, have authenticated users with access to the Add Campaign feature, and the Campaign Name field accepts unvalidated special characters that execute as formulas when campaign data is exported to CSV.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scopedImplement strict input validation on the Campaign Name field to strip or escape formula characters (=, +, -, @, tab, CR/LF) before storage, and apply proper CSV output encoding during export to prevent formula execution when the file is opened.
Nokia Impact Mobile 23_FP1 (Feature Pack 1) or later
- 1. Verify current Nokia Impact Mobile version by accessing the system administration panel or checking the product about page
- 2. Confirm the current version is within the affected range (>= 19.11, <= 23)
- 3. Obtain the Nokia Impact Mobile 23_FP1 (Feature Pack 1) release from the official Nokia software distribution portal or contact Nokia support
- 4. Review the upgrade documentation and release notes for Mobile 23_FP1
- 5. Perform a full backup of the current system configuration and database
- 6. Test the upgrade in a staging environment before applying to production
- 7. Apply the upgrade to production environment following Nokia's standard upgrade procedure
- 8. Verify the upgrade was successful by checking the version number
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation4.0 h
- Implementation8.0 h
- Testing4.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $5,120.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2023-31044 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2023-31044 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data