Security readout for executives and security teams
Plain-English summary
This CVE describes a cross-site scripting flaw in Deskpro’s manager profile download file feature. A malicious value could run script in another user’s browser if the vulnerable Deskpro version processes it. The source bundle says Deskpro 2021.1.6 was affected and Deskpro 2021.1.7 fixed it.
Executive priority
Treat this as a near-term maintenance fix if Deskpro is used. It is not KEV-listed in the provided data, but stored XSS in a support platform can affect trusted staff sessions and customer-service workflows.
Technical view
The issue is an XSS vulnerability caused by insufficient input validation in the download file feature on a manager profile. The provided CVE data does not include CVSS, CWE, CPE, or detailed exploit preconditions. The named affected release is Deskpro 2021.1.6, with a fix identified in 2021.1.7.
Likely exposure
Organizations using Deskpro cloud or on-premise Deskpro 2021.1.6 may be exposed. Exposure is unclear for other versions because the provided affected-product metadata is incomplete and lists no CPEs.
Exploitation context
The bundle does not show CISA KEV listing or active exploitation evidence. It includes a public researcher reference about stored XSS, so public technical awareness exists, but exploitation in the wild is not established here.
Researcher notes
Key gaps are missing CVSS, CWE, CPE, and detailed affected-version metadata. Validate against Deskpro version records and the referenced write-up, but avoid assuming impact beyond the manager profile download file feature described in the CVE source bundle.
Mitigation direction
- Upgrade on-premise Deskpro 2021.1.6 to 2021.1.7 or later.
- Confirm Deskpro cloud tenants received the vendor-fixed release.
- Check Deskpro vendor guidance for any additional remediation details.
- Restrict manager profile file-download access until fixed where practical.
Validation and detection
- Inventory Deskpro deployments and confirm exact product version.
- Verify whether any instance is running Deskpro 2021.1.6.
- Confirm cloud environments are on the fixed vendor-managed build.
- Review Deskpro security notes against this CVE before closure.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-36695 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.r29k.com/articles/bb/stored-xss-in-deskpro#anchor1CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.