PT-2021-13758 · Zoho · Manageengine Servicedesk Plus+1

Chris Lyne · Published 2021-04-09 · Updated 2021-04-19 · CVE-2021-20080

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: ManageEngine ServiceDesk Plus versions prior to 11200 ManageEngine AssetExplorer versions prior to 6800

Description: The issue is related to insufficient output sanitization, which allows a remote, unauthenticated attacker to conduct persistent cross-site scripting (XSS) attacks. This can be achieved by uploading a crafted XML asset file.

Recommendations: For ManageEngine ServiceDesk Plus versions prior to 11200, update to version 11200 or later. For ManageEngine AssetExplorer versions prior to 6800, update to version 6800 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-20080

Affected Products

Zoho Manageengine Assetexplorer

Manageengine Servicedesk Plus

References · 3

• 🔥 https://tenable.com/security/research/tra-2021-11 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-20080 · Security Note
• https://osv.dev/vulnerability/CVE-2021-20080 · Vendor Advisory