CVE-2021-39392

CRITICAL

Mylittletools Mylittlebackup < 1.7 - Insecure Deserialization

Title source: rule

Description

The management tool in MyLittleBackup up to and including 1.7 allows remote attackers to execute arbitrary code because machineKey is hardcoded (the same for all customers' installations) in web.config, and can be used to send serialized ASP code.

References (2)

Scores

CVSS v3 9.8
EPSS 0.0367
EPSS Percentile 87.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE
CWE-502
Status published

Affected Products (1)

mylittletools/mylittlebackup < 1.7

Timeline

Published Sep 15, 2021
Tracked Since Feb 18, 2026