Description
Insufficient output sanitization in ManageEngine ServiceDesk Plus before version 11200 and ManageEngine AssetExplorer before version 6800 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting (XSS) attacks by uploading a crafted XML asset file.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | ManageEngine ServiceDesk Plus | Before 11200 | — |
| — | ManageEngine AssetExplorer | Before 6800 | — |