{"id":"CVE-2021-33256","aliases":["EUVD-2021-19967","GHSA-x963-3p8c-j4m6"],"status":"disputed","title":"A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1...","description":"A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user. The j_username parameter seems to be vulnerable and a reverse shell could be obtained if a privileged user exports \"User Attempts Audit Report\" as CSV file. Note: The vendor disputes this vulnerability, claiming \"This is not a valid vulnerability in our ADSSP product. We don't see this as a security issue at our side.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.79003,"percentile":0.996,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-1236"],"published":"2021-08-09T13:28:42Z","modified":"2026-06-17T03:54:23Z","products":[{"vendor":"zohocorp","product":"manageengine_adselfservice_plus"}],"references":[{"url":"https://docs.unsafe-inline.com/0day/manageengine-adselfservice-plus-6.1-csv-injection","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33256"},{"url":"https://github.com/advisories/GHSA-x963-3p8c-j4m6"}],"sources":{"cve":[{"id":"CVE-2021-33256","description":"A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user. The j_username parameter seems to be vulnerable and a reverse shell could be obtained if a privileged user exports \"User Attempts Audit Report\" as CSV file. Note: The vendor disputes this vulnerability, claiming \"This is not a valid vulnerability in our ADSSP product. We don't see this as a security issue at our side.","status":"disputed","published":"2021-08-09T13:28:42Z","modified":"2024-08-03T23:42:20.271Z","updated_at":"2026-11-02T14:33:10.555814Z"}],"euvd":[{"id":"EUVD-2021-19967","description":"A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user. The j_username parameter seems to be vulnerable and a reverse shell could be obtained if a privileged user exports \"User Attempts Audit Report\" as CSV file. Note: The vendor disputes this vulnerability, claiming \"This is not a valid vulnerability in our ADSSP product. We don't see this as a security issue at our side.","status":"published","published":"2021-08-09T13:28:42Z","modified":"2024-08-03T23:42:20Z","updated_at":"2026-11-03T03:24:34.73748Z"}],"ghsa":[{"id":"GHSA-x963-3p8c-j4m6","title":"A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1...","description":"A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user. The j_username parameter seems to be vulnerable and a reverse shell could be obtained if a privileged user exports \"User Attempts Audit Report\" as CSV file.","status":"published","published":"2022-05-24T19:10:26Z","modified":"2024-03-30T05:01:45Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-1236"],"updated_at":"2026-11-02T14:55:45.190481Z"}],"nvd":[{"id":"CVE-2021-33256","description":"A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user. The j_username parameter seems to be vulnerable and a reverse shell could be obtained if a privileged user exports \"User Attempts Audit Report\" as CSV file. Note: The vendor disputes this vulnerability, claiming \"This is not a valid vulnerability in our ADSSP product. We don't see this as a security issue at our side.","status":"disputed","published":"2021-08-09T14:15:31.28Z","modified":"2026-06-17T03:54:23.677Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-1236"],"updated_at":"2026-11-02T14:06:56.562207Z"}]}}