{"api_version":"1","generated_at":"2026-07-23T09:43:55+00:00","cve":"CVE-2020-13166","urls":{"html":"https://cve.report/CVE-2020-13166","api":"https://cve.report/api/cve/CVE-2020-13166.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2020-13166","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-13166"},"summary":{"title":"CVE-2020-13166","description":"The management tool in MyLittleAdmin 3.8 allows remote attackers to execute arbitrary code because machineKey is hardcoded (the same for all customers' installations) in web.config, and can be used to send serialized ASP code.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2020-05-19 20:15:00","updated_at":"2022-04-26 19:34:00"},"problem_types":["CWE-798"],"metrics":[],"references":[{"url":"https://ssd-disclosure.com/ssd-advisory-mylittleadmin-preauth-rce/","name":"https://ssd-disclosure.com/ssd-advisory-mylittleadmin-preauth-rce/","refsource":"MISC","tags":["Exploit","Third Party Advisory"],"title":"SSD Advisory - MyLittleAdmin PreAuth RCE - SSD Secure Disclosure","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://packetstormsecurity.com/files/157808/Plesk-myLittleAdmin-ViewState-.NET-Deserialization.html","name":"http://packetstormsecurity.com/files/157808/Plesk-myLittleAdmin-ViewState-.NET-Deserialization.html","refsource":"MISC","tags":[],"title":"Plesk / myLittleAdmin ViewState .NET Deserialization ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-13166","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13166","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2020","cve_id":"13166","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mylittletools","cpe5":"mylittleadmin","cpe6":"3.8","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"13166","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mylittletools","cpe5":"mylittleadmin","cpe6":"3.8","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2020-13166","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The management tool in MyLittleAdmin 3.8 allows remote attackers to execute arbitrary code because machineKey is hardcoded (the same for all customers' installations) in web.config, and can be used to send serialized ASP code."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"url":"https://ssd-disclosure.com/ssd-advisory-mylittleadmin-preauth-rce/","refsource":"MISC","name":"https://ssd-disclosure.com/ssd-advisory-mylittleadmin-preauth-rce/"},{"refsource":"MISC","name":"http://packetstormsecurity.com/files/157808/Plesk-myLittleAdmin-ViewState-.NET-Deserialization.html","url":"http://packetstormsecurity.com/files/157808/Plesk-myLittleAdmin-ViewState-.NET-Deserialization.html"}]}},"nvd":{"publishedDate":"2020-05-19 20:15:00","lastModifiedDate":"2022-04-26 19:34:00","problem_types":["CWE-798"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"},"exploitabilityScore":3.9,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":7.5},"severity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:mylittletools:mylittleadmin:3.8:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2020","CveId":"13166","Ordinal":"174345","Title":"CVE-2020-13166","CVE":"CVE-2020-13166","Year":"2020"},"notes":[{"CveYear":"2020","CveId":"13166","Ordinal":"1","NoteData":"The management tool in MyLittleAdmin 3.8 allows remote attackers to execute arbitrary code because machineKey is hardcoded (the same for all customers' installations) in web.config, and can be used to send serialized ASP code.","Type":"Description","Title":null},{"CveYear":"2020","CveId":"13166","Ordinal":"2","NoteData":"2020-05-19","Type":"Other","Title":"Published"},{"CveYear":"2020","CveId":"13166","Ordinal":"3","NoteData":"2020-05-22","Type":"Other","Title":"Modified"}]}}}