CVE-2021-20080

MEDIUM 6.1CVE-2021-20080 · Published 09/04/2021 · updated 17/06/2026

Package	Affected versions	Patched versions
manageengine servicedesk plus zohocorp	`= 10.0= 10.0.0= 10.5= 11.0= 11.1= 8.1= 8.2= 9.0= 9.1= 9.2= 9.3= 9.4`	No fix yet

Description

Insufficient output sanitization in ManageEngine ServiceDesk Plus before version 11200 and ManageEngine AssetExplorer before version 6800 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting (XSS) attacks by uploading a crafted XML asset file.

References

tenable.com/security/research/tra-2021-11 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free