Vulnerability in Nmap

CVE-2013-4885

The http-domino-enum-passwords.nse script in NMap before 6.40, when domino-enum-passwords.idpath is set, allows remote servers to upload "arbitrarily named" files via a crafted FullName parameter in a response, as demonstrated using directory traversal sequences.

EPSS: 0.072 (93.7th percentile) — read the EPSS interpretation.

Affected products

  • Nmap — versions 2.1, 2.2, 2.3
  • Opensuse — versions 12.3
  • N/a — versions n/a

References