Vulnerability Description
The management tool in MyLittleBackup up to and including 1.7 allows remote attackers to execute arbitrary code because machineKey is hardcoded (the same for all customers' installations) in web.config, and can be used to send serialized ASP code.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mylittletools | Mylittlebackup | <= 1.7 |
Related Weaknesses (CWE)
References
- http://www.mylittlebackup.com/mlb/zip/mlb_1.7.zipBroken Link
- https://gist.github.com/omriinbar/65827626e63f15e3e50557e2d9d61281Third Party Advisory
- http://www.mylittlebackup.com/mlb/zip/mlb_1.7.zipBroken Link
- https://gist.github.com/omriinbar/65827626e63f15e3e50557e2d9d61281Third Party Advisory
FAQ
What is CVE-2021-39392?
CVE-2021-39392 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The management tool in MyLittleBackup up to and including 1.7 allows remote attackers to execute arbitrary code because machineKey is hardcoded (the same for all customers' installations) in web.confi...
How severe is CVE-2021-39392?
CVE-2021-39392 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2021-39392?
Check the references section above for vendor advisories and patch information. Affected products include: Mylittletools Mylittlebackup.