CVE-2021-27956

Published: May 20, 2021Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

Zoho ManageEngine ADSelfService Plus before 6104 allows stored XSS on the /webclient/index.html#/directory-search user search page via the e-mail address field.

Affected (4)

Products: Zohocorp: Manageengine Adselfservice Plus

1 product

Manageengine Adselfservice Plus

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Zohocorp Manageengine Adselfservice Plus	Before 6.1
Zohocorp Manageengine Adselfservice Plus	Version 6.1
Zohocorp Manageengine Adselfservice Plus	Version 6.1 6100
Zohocorp Manageengine Adselfservice Plus	Version 6.1 6103

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (6)

https://pitstop.manageengine.com/portal/en/community/topic/adselfservice-plus-6104-released-with-an-important-security-fixes

Source: cve@mitre.org

Vendor Advisory

https://raxis.com/blog/cve-2021-27956-manage-engine-xss

Source: cve@mitre.org

ExploitThird Party Advisory

https://www.manageengine.com

Source: cve@mitre.org

Vendor Advisory

https://pitstop.manageengine.com/portal/en/community/topic/adselfservice-plus-6104-released-with-an-important-security-fixes

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://raxis.com/blog/cve-2021-27956-manage-engine-xss

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://www.manageengine.com

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.