CVE-2013-4885
The http-domino-enum-passwords.nse script in NMap before 6.40, when domino-enum-passwords.idpath...
CVE-2013-4885 is a medium vulnerability (CVSS 6.8) in Nmap, published October 17, 2013. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 7.22%, the 94th percentile. Fixed in nmap 6.40-0.1.
The http-domino-enum-passwords.nse script in NMap before 6.40, when domino-enum-passwords.idpath is set, allows remote servers to upload "arbitrarily named" files via a crafted FullName parameter in a response, as demonstrated using directory traversal sequences.
Exploit likelihood
What each source reports
NVD Score used
The http-domino-enum-passwords.nse script in NMap before 6.40, when domino-enum-passwords.idpath is set, allows remote servers to upload "arbitrarily named" files via a crafted FullName parameter in a response, as demonstrated using directory traversal sequences.
- Record
CVE-2013-4885- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
The http-domino-enum-passwords.nse script in NMap before 6.40, when domino-enum-passwords.idpath is set, allows remote servers to upload "arbitrarily named" files via a crafted FullName parameter in a response, as demonstrated using directory traversal sequences.
- Record
CVE-2013-4885- Updated
- 2026-11-02
EUVDEUVD-2013-4730 No score
The http-domino-enum-passwords.nse script in NMap before 6.40, when domino-enum-passwords.idpath is set, allows remote servers to upload "arbitrarily named" files via a crafted FullName parameter in a response, as demonstrated using directory traversal sequences.
- Record
EUVD-2013-4730- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jrx5-35w9-xj26 No score
The http-domino-enum-passwords.nse script in NMap before 6.40, when domino-enum-passwords.idpath...
The http-domino-enum-passwords.nse script in NMap before 6.40, when domino-enum-passwords.idpath is set, allows remote servers to upload "arbitrarily named" files via a crafted FullName parameter in a response, as demonstrated using directory traversal sequences.
- Record
GHSA-jrx5-35w9-xj26- Updated
- 2026-11-02
OSV No score
The http-domino-enum-passwords.nse script in NMap before 6.40, when domino-enum-passwords.idpath is set, allows remote servers to upload "arbitrarily named" files via a crafted FullName parameter in a response, as demonstrated using directory traversal sequences.
- Record
CVE-2013-4885- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-4885 No score
The http-domino-enum-passwords.nse script in NMap before 6.40, when domino-enum-passwords.idpath is set, allows remote servers to upload "arbitrarily named" files via a crafted FullName parameter in a response, as demonstrated using directory traversal sequences.
- Record
DEBIAN-CVE-2013-4885- Updated
- 2026-11-02
OSVMGASA-2013-0305 No score
Updated nmap package fixes CVE-2013-4885
Updated nmap packages fix security vulnerability:
It is possible to write arbitrary files to a remote system, through a specially crafted server response for NMAP http-domino-enum-passwords.nse script from nmap before 6.40 (CVE-2013-4885).
- Record
MGASA-2013-0305- Updated
- 2026-11-02
Affected products
Affected packages
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Nmap - Arbitrary File Write | 2013-08-06 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
References
trustwave.com/spiderlabs/advisories/TWSL2013-025.txt
lists.opensuse.org/opensuse-updates/2013-10/msg00030.html
packetstormsecurity.com/files/122719/TWSL2013-025.txt
nmap.org/changelog.html
github.com/drk1wi/portspoof/commit/1791fe4e2b9e5b5c8e000551ab60a64a29d924c3