Insufficient output sanitization in ManageEngine ServiceDesk Plus before version 11200 and ManageEngine AssetExplorer before version 6800 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting (XSS) attacks by uploading a crafted XML asset file.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| n/a | ManageEngine ServiceDesk Plus | affected |
|
||||||
| n/a | ManageEngine AssetExplorer | affected |
|
Configuration 1 [-]
|
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
| Link | Providers |
|---|---|
| https://www.tenable.com/security/research/tra-2021-11 |
|
History
No history.
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: tenable
Published:
Updated: 2024-08-03T17:30:07.498Z
Reserved: 2020-12-17T00:00:00
Link: CVE-2021-20080
Vulnrichment
No data.
NVD
Status : Modified
Published: 2021-04-09T18:15:13.523
Modified: 2024-11-21T05:45:53.420
Link: CVE-2021-20080
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses