CVE-2021-33256 in the critical feed json
A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unau…
published 2021-08-09 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-19967
- cvss
- 8.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 79.0%
- EPSS 79.0% chance of exploitation in 30 days, percentile 99.5%
- public exploits
- 0
- none known
Summary
A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user. The j_username parameter seems to be vulnerable and a reverse shell could be obtained if a privileged user exports "User Attempts Audit Report" as CSV file. Note: The vendor disputes this vulnerability, claiming "This is not a valid vulnerability in our ADSSP product. We don't see this as a security issue at our side.
Exploit prediction
79.00% chance of exploitation in the next 30 days, higher than 99.5% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- docs.unsafe-inline.com https://docs.unsafe-inline.com/0day/manageengine-adselfservice-plus-6.1-csv-injection referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-1236 Improper Neutralization of Formula Elements in a CSV File
References
-
docs.unsafe-inline.com
/0day/manageengine-adselfservice-plus-6.1-csv-injection
exploit, third-party-advisory
Sources
- CVE List CVE-2021-33256
- NVD CVE-2021-33256
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.