PT-2021-13758
CVE-2021-20080
·
Published
2021-04-09
·
Updated
2021-04-19
Description by
CVSS 3.1
6.1
MediumMetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions:
ManageEngine ServiceDesk Plus versions prior to 11200
ManageEngine AssetExplorer versions prior to 6800
Description:
The issue is related to insufficient output sanitization, which allows a remote, unauthenticated attacker to conduct persistent cross-site scripting (XSS) attacks. This can be achieved by uploading a crafted XML asset file.
Recommendations:
For ManageEngine ServiceDesk Plus versions prior to 11200, update to version 11200 or later.
For ManageEngine AssetExplorer versions prior to 6800, update to version 6800 or later.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾