Vulnerability Details : CVE-2020-13166

Public exploit exists!
The management tool in MyLittleAdmin 3.8 allows remote attackers to execute arbitrary code because machineKey is hardcoded (the same for all customers' installations) in web.config, and can be used to send serialized ASP code.
Published 2020-05-19 20:15:10
Updated 2022-04-26 19:34:45
Source MITRE
View at NVD,   CVE.org
Vulnerability category: Execute code

Products affected by CVE-2020-13166

Exploit prediction scoring system (EPSS) score for CVE-2020-13166

EPSS FAQ
64.77%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 98 %
Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2020-13166

  • Plesk/myLittleAdmin ViewState .NET Deserialization
    Disclosure Date: 2020-05-15
    First seen: 2020-05-22
    exploit/windows/http/plesk_mylittleadmin_viewstate
    This module exploits a ViewState .NET deserialization vulnerability in web-based MS SQL Server management tool myLittleAdmin, for version 3.8 and likely older versions, due to hardcoded <machineKey> parameters in the web.config file for ASP.NET. Po

CVSS scores for CVE-2020-13166

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
7.5
 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P
10.0
6.4
 NIST
9.8
 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3.9
5.9
 NIST

CWE ids for CVE-2020-13166

References for CVE-2020-13166

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close