CVE-2021-40178

Published: Aug 29, 2021Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

Zoho ManageEngine Log360 before Build 5224 allows stored XSS via the LOGO_PATH key value in the logon settings.

Affected (12)

Products: Zohocorp: Manageengine Log360

1 product

Manageengine Log360

Configuration A

12 vulnerable

Vulnerable Software	Affected Versions
Zohocorp Manageengine Log360	Up to 5.1
Zohocorp Manageengine Log360	Version 5.2 build5200
Zohocorp Manageengine Log360	Version 5.2 build5201
Zohocorp Manageengine Log360	Version 5.2 build5206
Zohocorp Manageengine Log360	Version 5.2 build5209
Zohocorp Manageengine Log360	Version 5.2 build5210
Zohocorp Manageengine Log360	Version 5.2 build5211
Zohocorp Manageengine Log360	Version 5.2 build5213
Zohocorp Manageengine Log360	Version 5.2 build5214
Zohocorp Manageengine Log360	Version 5.2 build5218
Zohocorp Manageengine Log360	Version 5.2 build5219
Zohocorp Manageengine Log360	Version 5.2 build5220_beta

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://www.manageengine.com/log-management/readme.html#Build%205224

Source: cve@mitre.org

Release NotesVendor Advisory

https://www.manageengine.com/log-management/readme.html#Build%205224

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

Timeline

No history available yet.