CVE-2021-20080: XSS

Published Apr 9, 2021
·
Updated

Insufficient output sanitization in ManageEngine ServiceDesk Plus before version 11200 and ManageEngine AssetExplorer before version 6800 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting (XSS) attacks by uploading a crafted XML asset file.

Affected Software

276 affected components
ZohoCorp ManageEngine ServiceDesk Plus=8.1
ZohoCorp ManageEngine ServiceDesk Plus=8.2
ZohoCorp ManageEngine ServiceDesk Plus=8.2-8201
ZohoCorp ManageEngine ServiceDesk Plus=8.2-8202
ZohoCorp ManageEngine ServiceDesk Plus=8.2-8203
ZohoCorp ManageEngine ServiceDesk Plus=8.2-8204
ZohoCorp ManageEngine ServiceDesk Plus=8.2-8205
ZohoCorp ManageEngine ServiceDesk Plus=8.2-8206
ZohoCorp ManageEngine ServiceDesk Plus=8.2-8207
ZohoCorp ManageEngine ServiceDesk Plus=8.2-8208
ZohoCorp ManageEngine ServiceDesk Plus=8.2-8209
ZohoCorp ManageEngine ServiceDesk Plus=8.2-8210
ZohoCorp ManageEngine ServiceDesk Plus=8.2-8211
ZohoCorp ManageEngine ServiceDesk Plus=8.2-8212
ZohoCorp ManageEngine ServiceDesk Plus=8.2-8213
ZohoCorp ManageEngine ServiceDesk Plus=8.2-8214
ZohoCorp ManageEngine ServiceDesk Plus=8.2-8215
ZohoCorp ManageEngine ServiceDesk Plus=8.2-8216
ZohoCorp ManageEngine ServiceDesk Plus=8.2-8217
ZohoCorp ManageEngine ServiceDesk Plus=9.0
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9000
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9001
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9002
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9003
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9004
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9005
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9006
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9007
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9008
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9009
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9010
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9011
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9012
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9013
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9014
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9016
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9017
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9018
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9019
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9020
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9021
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9022
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9023
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9024
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9025
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9026
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9027
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9028
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9029
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9030
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9031
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9032
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9033
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9034
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9035
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9036
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9037
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9038
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9039
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9040
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9041
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9042
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9043
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9044
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9045
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9046
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9047
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9048
ZohoCorp ManageEngine ServiceDesk Plus=9.0-9049
ZohoCorp ManageEngine ServiceDesk Plus=9.1
ZohoCorp ManageEngine ServiceDesk Plus=9.1-9100
ZohoCorp ManageEngine ServiceDesk Plus=9.1-9101
ZohoCorp ManageEngine ServiceDesk Plus=9.1-9102
ZohoCorp ManageEngine ServiceDesk Plus=9.1-9103
ZohoCorp ManageEngine ServiceDesk Plus=9.1-9104
ZohoCorp ManageEngine ServiceDesk Plus=9.1-9105
ZohoCorp ManageEngine ServiceDesk Plus=9.1-9106
ZohoCorp ManageEngine ServiceDesk Plus=9.1-9107
ZohoCorp ManageEngine ServiceDesk Plus=9.1-9108
ZohoCorp ManageEngine ServiceDesk Plus=9.1-9109
ZohoCorp ManageEngine ServiceDesk Plus=9.1-9110
ZohoCorp ManageEngine ServiceDesk Plus=9.1-9111
ZohoCorp ManageEngine ServiceDesk Plus=9.1-9112
ZohoCorp ManageEngine ServiceDesk Plus=9.1-9113
ZohoCorp ManageEngine ServiceDesk Plus=9.1-9114
ZohoCorp ManageEngine ServiceDesk Plus=9.1-9115
ZohoCorp ManageEngine ServiceDesk Plus=9.1-9116
ZohoCorp ManageEngine ServiceDesk Plus=9.1-9117
ZohoCorp ManageEngine ServiceDesk Plus=9.1-9118
ZohoCorp ManageEngine ServiceDesk Plus=9.1-9119
ZohoCorp ManageEngine ServiceDesk Plus=9.1-9120
ZohoCorp ManageEngine ServiceDesk Plus=9.1-9121
ZohoCorp ManageEngine ServiceDesk Plus=9.2
ZohoCorp ManageEngine ServiceDesk Plus=9.2-9200
ZohoCorp ManageEngine ServiceDesk Plus=9.2-9201
ZohoCorp ManageEngine ServiceDesk Plus=9.2-9202
ZohoCorp ManageEngine ServiceDesk Plus=9.2-9203
ZohoCorp ManageEngine ServiceDesk Plus=9.2-9204
ZohoCorp ManageEngine ServiceDesk Plus=9.2-9205
ZohoCorp ManageEngine ServiceDesk Plus=9.2-9206
ZohoCorp ManageEngine ServiceDesk Plus=9.2-9207
ZohoCorp ManageEngine ServiceDesk Plus=9.2-9208
ZohoCorp ManageEngine ServiceDesk Plus=9.2-9209
ZohoCorp ManageEngine ServiceDesk Plus=9.2-9210
ZohoCorp ManageEngine ServiceDesk Plus=9.2-9211
ZohoCorp ManageEngine ServiceDesk Plus=9.2-9212
ZohoCorp ManageEngine ServiceDesk Plus=9.2-9213
ZohoCorp ManageEngine ServiceDesk Plus=9.2-9214
ZohoCorp ManageEngine ServiceDesk Plus=9.2-9215
ZohoCorp ManageEngine ServiceDesk Plus=9.2-9216
ZohoCorp ManageEngine ServiceDesk Plus=9.2-9217
ZohoCorp ManageEngine ServiceDesk Plus=9.2-9218
ZohoCorp ManageEngine ServiceDesk Plus=9.2-9219
ZohoCorp ManageEngine ServiceDesk Plus=9.2-9220
ZohoCorp ManageEngine ServiceDesk Plus=9.2-9221
ZohoCorp ManageEngine ServiceDesk Plus=9.2-9222
ZohoCorp ManageEngine ServiceDesk Plus=9.2-9223
ZohoCorp ManageEngine ServiceDesk Plus=9.2-9224
ZohoCorp ManageEngine ServiceDesk Plus=9.2-9225
ZohoCorp ManageEngine ServiceDesk Plus=9.2-9226
ZohoCorp ManageEngine ServiceDesk Plus=9.2-9227
ZohoCorp ManageEngine ServiceDesk Plus=9.2-9228
ZohoCorp ManageEngine ServiceDesk Plus=9.2-9229
ZohoCorp ManageEngine ServiceDesk Plus=9.2-9230
ZohoCorp ManageEngine ServiceDesk Plus=9.2-9231
ZohoCorp ManageEngine ServiceDesk Plus=9.2-9232
ZohoCorp ManageEngine ServiceDesk Plus=9.2-9233
ZohoCorp ManageEngine ServiceDesk Plus=9.2-9234
ZohoCorp ManageEngine ServiceDesk Plus=9.2-9235
ZohoCorp ManageEngine ServiceDesk Plus=9.2-9236
ZohoCorp ManageEngine ServiceDesk Plus=9.2-9237
ZohoCorp ManageEngine ServiceDesk Plus=9.2-9238
ZohoCorp ManageEngine ServiceDesk Plus=9.2-9239
ZohoCorp ManageEngine ServiceDesk Plus=9.2-9240
ZohoCorp ManageEngine ServiceDesk Plus=9.2-9241
ZohoCorp ManageEngine ServiceDesk Plus=9.2-9242
ZohoCorp ManageEngine ServiceDesk Plus=9.3
ZohoCorp ManageEngine ServiceDesk Plus=9.3-9300
ZohoCorp ManageEngine ServiceDesk Plus=9.3-9301
ZohoCorp ManageEngine ServiceDesk Plus=9.3-9302
ZohoCorp ManageEngine ServiceDesk Plus=9.3-9303
ZohoCorp ManageEngine ServiceDesk Plus=9.3-9304
ZohoCorp ManageEngine ServiceDesk Plus=9.3-9305
ZohoCorp ManageEngine ServiceDesk Plus=9.3-9306
ZohoCorp ManageEngine ServiceDesk Plus=9.3-9307
ZohoCorp ManageEngine ServiceDesk Plus=9.3-9308
ZohoCorp ManageEngine ServiceDesk Plus=9.3-9309
ZohoCorp ManageEngine ServiceDesk Plus=9.3-9310
ZohoCorp ManageEngine ServiceDesk Plus=9.3-9311
ZohoCorp ManageEngine ServiceDesk Plus=9.3-9312
ZohoCorp ManageEngine ServiceDesk Plus=9.3-9313
ZohoCorp ManageEngine ServiceDesk Plus=9.3-9314
ZohoCorp ManageEngine ServiceDesk Plus=9.3-9315
ZohoCorp ManageEngine ServiceDesk Plus=9.3-9316
ZohoCorp ManageEngine ServiceDesk Plus=9.3-9317
ZohoCorp ManageEngine ServiceDesk Plus=9.3-9318
ZohoCorp ManageEngine ServiceDesk Plus=9.3-9319
ZohoCorp ManageEngine ServiceDesk Plus=9.3-9320
ZohoCorp ManageEngine ServiceDesk Plus=9.3-9321
ZohoCorp ManageEngine ServiceDesk Plus=9.3-9322
ZohoCorp ManageEngine ServiceDesk Plus=9.3-9323
ZohoCorp ManageEngine ServiceDesk Plus=9.3-9324
ZohoCorp ManageEngine ServiceDesk Plus=9.3-9325
ZohoCorp ManageEngine ServiceDesk Plus=9.3-9326
ZohoCorp ManageEngine ServiceDesk Plus=9.3-9327
ZohoCorp ManageEngine ServiceDesk Plus=9.3-9328
ZohoCorp ManageEngine ServiceDesk Plus=9.3-9329
ZohoCorp ManageEngine ServiceDesk Plus=9.3-9330
ZohoCorp ManageEngine ServiceDesk Plus=9.3-9331
ZohoCorp ManageEngine ServiceDesk Plus=9.3-9332
ZohoCorp ManageEngine ServiceDesk Plus=9.3-9333
ZohoCorp ManageEngine ServiceDesk Plus=9.3-9334
ZohoCorp ManageEngine ServiceDesk Plus=9.3-9335
ZohoCorp ManageEngine ServiceDesk Plus=9.3-9336
ZohoCorp ManageEngine ServiceDesk Plus=9.4
ZohoCorp ManageEngine ServiceDesk Plus=9.4-9400
ZohoCorp ManageEngine ServiceDesk Plus=9.4-9401
ZohoCorp ManageEngine ServiceDesk Plus=9.4-9402
ZohoCorp ManageEngine ServiceDesk Plus=9.4-9403
ZohoCorp ManageEngine ServiceDesk Plus=9.4-9404
ZohoCorp ManageEngine ServiceDesk Plus=9.4-9405
ZohoCorp ManageEngine ServiceDesk Plus=9.4-9406
ZohoCorp ManageEngine ServiceDesk Plus=9.4-9407
ZohoCorp ManageEngine ServiceDesk Plus=9.4-9408
ZohoCorp ManageEngine ServiceDesk Plus=9.4-9409
ZohoCorp ManageEngine ServiceDesk Plus=9.4-9410
ZohoCorp ManageEngine ServiceDesk Plus=9.4-9411
ZohoCorp ManageEngine ServiceDesk Plus=9.4-9412
ZohoCorp ManageEngine ServiceDesk Plus=9.4-9413
ZohoCorp ManageEngine ServiceDesk Plus=9.4-9414
ZohoCorp ManageEngine ServiceDesk Plus=9.4-9415
ZohoCorp ManageEngine ServiceDesk Plus=9.4-9416
ZohoCorp ManageEngine ServiceDesk Plus=9.4-9417
ZohoCorp ManageEngine ServiceDesk Plus=9.4-9418
ZohoCorp ManageEngine ServiceDesk Plus=9.4-9419
ZohoCorp ManageEngine ServiceDesk Plus=9.4-9420
ZohoCorp ManageEngine ServiceDesk Plus=9.4-9421
ZohoCorp ManageEngine ServiceDesk Plus=9.4-9422
ZohoCorp ManageEngine ServiceDesk Plus=9.4-9423
ZohoCorp ManageEngine ServiceDesk Plus=9.4-9424
ZohoCorp ManageEngine ServiceDesk Plus=9.4-9425
ZohoCorp ManageEngine ServiceDesk Plus=9.4-9426
ZohoCorp ManageEngine ServiceDesk Plus=9.4-9427
ZohoCorp ManageEngine ServiceDesk Plus=10.0
ZohoCorp ManageEngine ServiceDesk Plus=10.0.0
ZohoCorp ManageEngine ServiceDesk Plus=10.0.0-10000
ZohoCorp ManageEngine ServiceDesk Plus=10.0.0-10001
ZohoCorp ManageEngine ServiceDesk Plus=10.0.0-10002
ZohoCorp ManageEngine ServiceDesk Plus=10.0.0-10003
ZohoCorp ManageEngine ServiceDesk Plus=10.0.0-10004
ZohoCorp ManageEngine ServiceDesk Plus=10.0.0-10005
ZohoCorp ManageEngine ServiceDesk Plus=10.0.0-10006
ZohoCorp ManageEngine ServiceDesk Plus=10.0.0-10007
ZohoCorp ManageEngine ServiceDesk Plus=10.0.0-10008
ZohoCorp ManageEngine ServiceDesk Plus=10.0.0-10009
ZohoCorp ManageEngine ServiceDesk Plus=10.0.0-10010
ZohoCorp ManageEngine ServiceDesk Plus=10.0.0-10011
ZohoCorp ManageEngine ServiceDesk Plus=10.0.0-10012
ZohoCorp ManageEngine ServiceDesk Plus=10.0.0-10013
ZohoCorp ManageEngine ServiceDesk Plus=10.0.0-10014
ZohoCorp ManageEngine ServiceDesk Plus=10.0.0-10015
ZohoCorp ManageEngine ServiceDesk Plus=10.0.0-10016
ZohoCorp ManageEngine ServiceDesk Plus=10.0.0-10017
ZohoCorp ManageEngine ServiceDesk Plus=10.0.0-10018
ZohoCorp ManageEngine ServiceDesk Plus=10.0.0-10019
ZohoCorp ManageEngine ServiceDesk Plus=10.0.0-10020
ZohoCorp ManageEngine ServiceDesk Plus=10.0.0-10021
ZohoCorp ManageEngine ServiceDesk Plus=10.5
ZohoCorp ManageEngine ServiceDesk Plus=10.5-10500
ZohoCorp ManageEngine ServiceDesk Plus=10.5-10501
ZohoCorp ManageEngine ServiceDesk Plus=10.5-10502
ZohoCorp ManageEngine ServiceDesk Plus=10.5-10503
ZohoCorp ManageEngine ServiceDesk Plus=10.5-10504
ZohoCorp ManageEngine ServiceDesk Plus=10.5-10505
ZohoCorp ManageEngine ServiceDesk Plus=10.5-10506
ZohoCorp ManageEngine ServiceDesk Plus=10.5-10507
ZohoCorp ManageEngine ServiceDesk Plus=10.5-10508
ZohoCorp ManageEngine ServiceDesk Plus=10.5-10509
ZohoCorp ManageEngine ServiceDesk Plus=10.5-10510
ZohoCorp ManageEngine ServiceDesk Plus=10.5-10511
ZohoCorp ManageEngine ServiceDesk Plus=10.5-10512
ZohoCorp ManageEngine ServiceDesk Plus=10.5-10513
ZohoCorp ManageEngine ServiceDesk Plus=10.5-10514
ZohoCorp ManageEngine ServiceDesk Plus=11.0
ZohoCorp ManageEngine ServiceDesk Plus=11.0-11000
ZohoCorp ManageEngine ServiceDesk Plus=11.0-11001
ZohoCorp ManageEngine ServiceDesk Plus=11.0-11002
ZohoCorp ManageEngine ServiceDesk Plus=11.0-11003
ZohoCorp ManageEngine ServiceDesk Plus=11.0-11004
ZohoCorp ManageEngine ServiceDesk Plus=11.0-11005
ZohoCorp ManageEngine ServiceDesk Plus=11.0-11006
ZohoCorp ManageEngine ServiceDesk Plus=11.0-11007
ZohoCorp ManageEngine ServiceDesk Plus=11.0-11008
ZohoCorp ManageEngine ServiceDesk Plus=11.0-11009
ZohoCorp ManageEngine ServiceDesk Plus=11.0-11010
ZohoCorp ManageEngine ServiceDesk Plus=11.1
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11100
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11101
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11102
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11103
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11104
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11105
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11106
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11107
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11108
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11109
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11110
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11111
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11112
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11113
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11114
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11115
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11116
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11117
ZohoCorp ManageEngine ServiceDesk Plus=11.1-build11118
ZohoCorp ManageEngine ServiceDesk Plus=11.1-build11119

Event History

Apr 9, 2021
CVE Published
via MITRE·05:21 PM
Data Sourced
via MITRE·05:21 PM
DescriptionWeakness
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2021-20080?

CVE-2021-20080 is classified as a high severity vulnerability due to its potential for persistent cross-site scripting (XSS) attacks.

2

How do I fix CVE-2021-20080?

To fix CVE-2021-20080, users should update their ManageEngine ServiceDesk Plus and AssetExplorer to versions 11200 and 6800 or later, respectively.

3

Who is affected by CVE-2021-20080?

CVE-2021-20080 affects users of ManageEngine ServiceDesk Plus versions prior to 11200 and AssetExplorer versions before 6800.

4

What type of attack can be executed using CVE-2021-20080?

CVE-2021-20080 allows remote, unauthenticated attackers to conduct persistent cross-site scripting (XSS) attacks.

5

What does insufficient output sanitization mean in the context of CVE-2021-20080?

Insufficient output sanitization in CVE-2021-20080 means that the application fails to properly clean or escape user input, leading to the potential execution of malicious scripts.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203