Vulnerability · Published Apr 9, 2021 · Assigned by tenable
CVE-2021-20080
Medium 6.1
In plain English
A medium-severity security flaw in ManageEngine AssetExplorer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 93.1% (higher than 99.8% of all known vulnerabilities).
Severity (CVSS NVD)6.1Medium
Exploit odds (30 days)93.1%top 0.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Insufficient output sanitization in ManageEngine ServiceDesk Plus before version 11200 and ManageEngine AssetExplorer before version 6800 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting (XSS) attacks by uploading a crafted XML asset file.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | ManageEngine ServiceDesk Plus | Before 11200 |
| n/a | ManageEngine AssetExplorer | Before 6800 |
References
- https://www.tenable.com/security/research/tra-2021-11 x_refsource_MISC