CVE-2021-20080
MEDIUM
6.1
CVSS Score
Published: April 9, 2021 at 05:21 PM UTC
Updated: June 17, 2026 at 03:33 AM UTC
2 products affected across 1 vendorManageengine Servicedesk PlusManageEngine AssetExplorer
Using ManageEngine ServiceDesk Plus by N/A?
Get instant alerts when new vulnerabilities affect ManageEngine ServiceDesk Plus - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM6.1
Exploit prediction
EPSS 93%
Description
Insufficient output sanitization in ManageEngine ServiceDesk Plus before version 11200 and ManageEngine AssetExplorer before version 6800 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting (XSS) attacks by uploading a crafted XML asset file.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
v < 1120010.010.0.010.0.0 1000010.0.0 1000110.0.0 1000210.0.0 1000310.0.0 1000410.0.0 1000510.0.0 1000610.0.0 1000710.0.0 1000810.0.0 1000910.0.0 1001010.0.0 1001110.0.0 1001210.0.0 1001310.0.0 1001410.0.0 1001510.0.0 1001610.0.0 1001710.0.0 1001810.0.0 1001910.0.0 1002010.0.0 1002110.510.5 1050010.5 1050110.5 1050210.5 1050310.5 1050410.5 1050510.5 1050610.5 1050710.5 1050810.5 1050910.5 1051010.5 1051110.5 1051210.5 1051310.5 1051411.011.0 1100011.0 1100111.0 1100211.0 1100311.0 1100411.0 1100511.0 1100611.0 1100711.0 1100811.0 1100911.0 1101011.111.1 1110011.1 1110111.1 1110211.1 1110311.1 1110411.1 1110511.1 1110611.1 1110711.1 1110811.1 1110911.1 1111011.1 1111111.1 1111211.1 1111311.1 1111411.1 1111511.1 1111611.1 1111711.1 build1111811.1 build111198.18.28.2 82018.2 82028.2 82038.2 82048.2 82058.2 82068.2 82078.2 82088.2 82098.2 82108.2 82118.2 82128.2 82138.2 82148.2 82158.2 82168.2 82179.09.0 90009.0 90019.0 90029.0 90039.0 90049.0 90059.0 90069.0 90079.0 90089.0 90099.0 90109.0 90119.0 90129.0 90139.0 90149.0 90169.0 90179.0 90189.0 90199.0 90209.0 90219.0 90229.0 90239.0 90249.0 90259.0 90269.0 90279.0 90289.0 90299.0 90309.0 90319.0 90329.0 90339.0 90349.0 90359.0 90369.0 90379.0 90389.0 90399.0 90409.0 90419.0 90429.0 90439.0 90449.0 90459.0 90469.0 90479.0 90489.0 90499.19.1 91009.1 91019.1 91029.1 91039.1 91049.1 91059.1 91069.1 91079.1 91089.1 91099.1 91109.1 91119.1 91129.1 91139.1 91149.1 91159.1 91169.1 91179.1 91189.1 91199.1 91209.1 91219.29.2 92009.2 92019.2 92029.2 92039.2 92049.2 92059.2 92069.2 92079.2 92089.2 92099.2 92109.2 92119.2 92129.2 92139.2 92149.2 92159.2 92169.2 92179.2 92189.2 92199.2 92209.2 92219.2 92229.2 92239.2 92249.2 92259.2 92269.2 92279.2 92289.2 92299.2 92309.2 92319.2 92329.2 92339.2 92349.2 92359.2 92369.2 92379.2 92389.2 92399.2 92409.2 92419.2 92429.39.3 93009.3 93019.3 93029.3 93039.3 93049.3 93059.3 93069.3 93079.3 93089.3 93099.3 93109.3 93119.3 93129.3 93139.3 93149.3 93159.3 93169.3 93179.3 93189.3 93199.3 93209.3 93219.3 93229.3 93239.3 93249.3 93259.3 93269.3 93279.3 93289.3 93299.3 93309.3 93319.3 93329.3 93339.3 93349.3 93359.3 93369.49.4 94009.4 94019.4 94029.4 94039.4 94049.4 94059.4 94069.4 94079.4 94089.4 94099.4 94109.4 94119.4 94129.4 94139.4 94149.4 94159.4 94169.4 94179.4 94189.4 94199.4 94209.4 94219.4 94229.4 94239.4 94249.4 94259.4 94269.4 9427
Affected range stops below 11200, so it looks safe — our inference, not a vendor statement
v < 6800
Affected range stops below 6800, so it looks safe — our inference, not a vendor statement
Remediation
No guide yetNo remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.
References (1)
x_refsource_MISCExploitThird Party Advisory
Source: [email protected]
https://www.tenable.com/security/research/tra-2021-11CVSS
- Attack Vector
- NETWORK
- Complexity
- LOW
- Privileges
- NONE
- User Interaction
- REQUIRED
- Scope
- CHANGED
- Confidentiality
- LOW
- Integrity
- LOW
- Availability
- NONE
Vector?
Quick Info
StatusMODIFIED
CWE
CWE-79
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card