CVE-2013-4885 The http-domino-enum-passwords.nse script in NMap before 6.40, when domino-enum-passwords.idpath is set, allows remote servers to upload "arbitrarily named" files via a crafted FullName parameter in a...

MediumCVSS 6.8 EPSS 7.2% Public exploit

Published: 2013-10-26 20:00
Updated: 2026-09-01 23:03
Exploit status: Public exploit available

Description

The http-domino-enum-passwords.nse script in NMap before 6.40, when domino-enum-passwords.idpath is set, allows remote servers to upload "arbitrarily named" files via a crafted FullName parameter in a response, as demonstrated using directory traversal sequences.

Affected products

Product	Affected versions	Fixed in
debian/nmap(Debian:12)	< 6.40-0.1	6.40-0.1
debian/nmap(Debian:13)	< 6.40-0.1	6.40-0.1
debian/nmap(Debian:14)	< 6.40-0.1	6.40-0.1
Nmap	<= 6.25	No fix listed
Nmap	= 2.1-beta1	No fix listed
Nmap	= 2.2-beta2	No fix listed
Nmap	= 2.2-beta3	No fix listed
Nmap	= 2.2-beta4	No fix listed
Nmap	= 2.3-beta10	No fix listed
Nmap	= 2.3-beta12	No fix listed
Nmap	= 2.3-beta13	No fix listed
Nmap	= 2.3-beta14	No fix listed
Nmap	= 2.3-beta17	No fix listed
Nmap	= 2.3-beta18	No fix listed
Nmap	= 2.3-beta19	No fix listed
Nmap	= 2.3-beta20	No fix listed
Nmap	= 2.3-beta21	No fix listed
Nmap	= 2.3-beta4	No fix listed
Nmap	= 2.3-beta5	No fix listed
Nmap	= 2.3-beta6	No fix listed
Nmap	= 2.3-beta8	No fix listed
Nmap	= 2.3-beta9	No fix listed
Nmap	= 2.05	No fix listed
Nmap	= 2.06	No fix listed
Nmap	= 2.07	No fix listed

Show 168 more

Product	Affected versions	Fixed in
Nmap	= 2.08	No fix listed
Nmap	= 2.09	No fix listed
Nmap	= 2.10	No fix listed
Nmap	= 2.11	No fix listed
Nmap	= 2.12	No fix listed
Nmap	= 2.50	No fix listed
Nmap	= 2.51	No fix listed
Nmap	= 2.52	No fix listed
Nmap	= 2.53	No fix listed
Nmap	= 2.54-beta1	No fix listed
Nmap	= 2.54-beta16	No fix listed
Nmap	= 2.54-beta19	No fix listed
Nmap	= 2.54-beta2	No fix listed
Nmap	= 2.54-beta20	No fix listed
Nmap	= 2.54-beta21	No fix listed
Nmap	= 2.54-beta22	No fix listed
Nmap	= 2.54-beta24	No fix listed
Nmap	= 2.54-beta25	No fix listed
Nmap	= 2.54-beta26	No fix listed
Nmap	= 2.54-beta27	No fix listed
Nmap	= 2.54-beta28	No fix listed
Nmap	= 2.54-beta29	No fix listed
Nmap	= 2.54-beta3	No fix listed
Nmap	= 2.54-beta30	No fix listed
Nmap	= 2.54-beta31	No fix listed
Nmap	= 2.54-beta32	No fix listed
Nmap	= 2.54-beta33	No fix listed
Nmap	= 2.54-beta34	No fix listed
Nmap	= 2.54-beta35	No fix listed
Nmap	= 2.54-beta36	No fix listed
Nmap	= 2.54-beta37	No fix listed
Nmap	= 2.54-beta4	No fix listed
Nmap	= 2.54-beta5	No fix listed
Nmap	= 2.54-beta6	No fix listed
Nmap	= 2.54-beta7	No fix listed
Nmap	= 2.99-rc1	No fix listed
Nmap	= 2.99-rc2	No fix listed
Nmap	= 3.00	No fix listed
Nmap	= 3.10-alpha1	No fix listed
Nmap	= 3.10-alpha2	No fix listed
Nmap	= 3.10-alpha3	No fix listed
Nmap	= 3.10-alpha4	No fix listed
Nmap	= 3.10-alpha5	No fix listed
Nmap	= 3.10-alpha7	No fix listed
Nmap	= 3.10-alpha9	No fix listed
Nmap	= 3.15-beta1	No fix listed
Nmap	= 3.15-beta2	No fix listed
Nmap	= 3.15-beta3	No fix listed
Nmap	= 3.20	No fix listed
Nmap	= 3.25	No fix listed
Nmap	= 3.26	No fix listed
Nmap	= 3.27	No fix listed
Nmap	= 3.28	No fix listed
Nmap	= 3.30	No fix listed
Nmap	= 3.40-pvt1	No fix listed
Nmap	= 3.40-pvt10	No fix listed
Nmap	= 3.40-pvt11	No fix listed
Nmap	= 3.40-pvt12	No fix listed
Nmap	= 3.40-pvt13	No fix listed
Nmap	= 3.40-pvt14	No fix listed
Nmap	= 3.40-pvt15	No fix listed
Nmap	= 3.40-pvt16	No fix listed
Nmap	= 3.40-pvt17	No fix listed
Nmap	= 3.40-pvt2	No fix listed
Nmap	= 3.40-pvt3	No fix listed
Nmap	= 3.40-pvt4	No fix listed
Nmap	= 3.40-pvt6	No fix listed
Nmap	= 3.40-pvt7	No fix listed
Nmap	= 3.40-pvt8	No fix listed
Nmap	= 3.40-pvt9	No fix listed
Nmap	= 3.45	No fix listed
Nmap	= 3.48	No fix listed
Nmap	= 3.50	No fix listed
Nmap	= 3.55	No fix listed
Nmap	= 3.70	No fix listed
Nmap	= 3.75	No fix listed
Nmap	= 3.81	No fix listed
Nmap	= 3.90	No fix listed
Nmap	= 3.91	No fix listed
Nmap	= 3.93	No fix listed
Nmap	= 3.94-alpha1	No fix listed
Nmap	= 3.94-alpha2	No fix listed
Nmap	= 3.94-alpha3	No fix listed
Nmap	= 3.95	No fix listed
Nmap	= 3.96-beta1	No fix listed
Nmap	= 3.98-beta1	No fix listed
Nmap	= 3.99	No fix listed
Nmap	= 3.999	No fix listed
Nmap	= 3.9999	No fix listed
Nmap	= 4.00	No fix listed
Nmap	= 4.01	No fix listed
Nmap	= 4.02-alpha1	No fix listed
Nmap	= 4.02-alpha2	No fix listed
Nmap	= 4.03	No fix listed
Nmap	= 4.04-beta1	No fix listed
Nmap	= 4.10	No fix listed
Nmap	= 4.11	No fix listed
Nmap	= 4.20	No fix listed
Nmap	= 4.20-alpha1	No fix listed
Nmap	= 4.20-alpha10	No fix listed
Nmap	= 4.20-alpha11	No fix listed
Nmap	= 4.20-alpha2	No fix listed
Nmap	= 4.20-alpha3	No fix listed
Nmap	= 4.20-alpha4	No fix listed
Nmap	= 4.20-alpha5	No fix listed
Nmap	= 4.20-alpha6	No fix listed
Nmap	= 4.20-alpha7	No fix listed
Nmap	= 4.20-alpha8	No fix listed
Nmap	= 4.20-alpha9	No fix listed
Nmap	= 4.20-rc1	No fix listed
Nmap	= 4.20-rc2	No fix listed
Nmap	= 4.21-alpha1	No fix listed
Nmap	= 4.21-alpha2	No fix listed
Nmap	= 4.21-alpha3	No fix listed
Nmap	= 4.21-alpha4	No fix listed
Nmap	= 4.22-soc1	No fix listed
Nmap	= 4.22-soc2	No fix listed
Nmap	= 4.22-soc3	No fix listed
Nmap	= 4.22-soc5	No fix listed
Nmap	= 4.22-soc6	No fix listed
Nmap	= 4.22-soc7	No fix listed
Nmap	= 4.22-soc8	No fix listed
Nmap	= 4.49-rc1	No fix listed
Nmap	= 4.49-rc2	No fix listed
Nmap	= 4.49-rc3	No fix listed
Nmap	= 4.49-rc4	No fix listed
Nmap	= 4.49-rc5	No fix listed
Nmap	= 4.49-rc6	No fix listed
Nmap	= 4.49-rc7	No fix listed
Nmap	= 4.50	No fix listed
Nmap	= 4.51-beta	No fix listed
Nmap	= 4.52	No fix listed
Nmap	= 4.53	No fix listed
Nmap	= 4.60	No fix listed
Nmap	= 4.62	No fix listed
Nmap	= 4.65	No fix listed
Nmap	= 4.68	No fix listed
Nmap	= 4.75	No fix listed
Nmap	= 4.76	No fix listed
Nmap	= 4.85-beta1	No fix listed
Nmap	= 4.85-beta10	No fix listed
Nmap	= 4.85-beta2	No fix listed
Nmap	= 4.85-beta3	No fix listed
Nmap	= 4.85-beta4	No fix listed
Nmap	= 4.85-beta5	No fix listed
Nmap	= 4.85-beta6	No fix listed
Nmap	= 4.85-beta7	No fix listed
Nmap	= 4.85-beta8	No fix listed
Nmap	= 4.85-beta9	No fix listed
Nmap	= 4.90-rc1	No fix listed
Nmap	= 5.00	No fix listed
Nmap	= 5.10-beta1	No fix listed
Nmap	= 5.10-beta2	No fix listed
Nmap	= 5.20	No fix listed
Nmap	= 5.21	No fix listed
Nmap	= 5.30-beta1	No fix listed
Nmap	= 5.35-dc1	No fix listed
Nmap	= 5.50	No fix listed
Nmap	= 5.51	No fix listed
Nmap	= 5.59-beta1	No fix listed
Nmap	= 5.61-test1	No fix listed
Nmap	= 5.61-test2	No fix listed
Nmap	= 5.61-test4	No fix listed
Nmap	= 5.61-test5	No fix listed
Nmap	= 6.00	No fix listed
Nmap	= 6.01	No fix listed
Nmap	= 6.20-beta1	No fix listed
opensuse	= 12.3	No fix listed

References

Debian Security Tracker CVE-2013-4885 vendor-advisory
bugs.debian.org issue-tracking
openSUSE-SU-2013:1561 vendor-advisory
openSUSE-SU-2013:1579 vendor-advisory
nmap.org
packetstormsecurity.com exploit
github.com exploit patch
www.trustwave.com exploit

CVSS v2.0

6.8 Medium

AV:N/AC:M/Au:N/C:P/I:P/A:P

Access Vector: Network
Access Complexity: Medium
Authentication: None
Confidentiality: Partial
Integrity: Partial
Availability: Partial

Weakness & likelihood

EPSS (exploitation probability, 30 days): 7.22% (percentile 94.4)
CWE: Not classified

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

Nmap - Arbitrary File Write Exploit · Exploit Database (OffSec) · 2013-08-06