CVE-2021-33256: ManageEngine ADSelfService Plus login panel CSV injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityCVSS 8.8 and a very high EPSS score indicate significant risk, though exploitation requires a privileged user to export and open the CSV, and the vendor disputes the issue.

What it is

The login panel of ManageEngine ADSelfService Plus 6.1 (build 6101) fails to sanitize the j_username parameter, allowing CSV injection. When a privileged user exports the "User Attempts Audit Report" as a CSV file, injected formulas can execute, potentially leading to a reverse shell. The vendor disputes this, stating it is not a valid vulnerability in their product.

Impact

An unauthenticated attacker can inject malicious content that executes when a privileged administrator opens the exported CSV report, potentially gaining code execution in the context of that user.

Attack surface

Reachable over the network through the login panel's j_username parameter with no authentication required, but exploitation depends on a privileged user exporting the audit report as CSV, so user interaction is required.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.79, 99.6th percentile) and the only references are tagged Exploit and Third Party Advisory, indicating public exploit detail exists.

What to do

• Apply the latest ADSelfService Plus build from the vendor, since the affected 6.1 build 6101 is old; verify whether the vendor has addressed the disputed issue in a later release.
• Restrict access to the login panel and audit report export functionality to trusted networks or administrators only.
• Sanitize or escape user-supplied input such as j_username before it is written into exported CSV files.
• Train privileged users not to open exported CSV reports in spreadsheet software that evaluates formulas, or open them in a safe viewer.
• Monitor vendor advisories because the vendor disputes the finding and may not issue a fix.

Detection

• Review ADSelfService Plus logs for suspicious characters (for example =, +, -, @) in the j_username parameter of login attempts.
• Monitor for unexpected outbound connections from hosts where administrators open exported CSV reports.
• Audit creation and access of "User Attempts Audit Report" CSV exports for unusual timing or volume.
• Inspect exported CSV files for formula-like content before they are opened.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.