Vulnerabilities > CVE-2013-4885

047910
CVSS 0.0 - NONE
Attack vector
UNKNOWN
Attack complexity
UNKNOWN
Privileges required
UNKNOWN
Confidentiality impact
UNKNOWN
Integrity impact
UNKNOWN
Availability impact
UNKNOWN
nmap
opensuse
nessus
exploit available
NVD
Published: 2013-10-26
Updated: 2024-11-21

Summary

The http-domino-enum-passwords.nse script in NMap before 6.40, when domino-enum-passwords.idpath is set, allows remote servers to upload "arbitrarily named" files via a crafted FullName parameter in a response, as demonstrated using directory traversal sequences.

Vulnerable Configurations

Part Description Count
Application
Nmap
190
OS
Opensuse
1

Exploit-Db

descriptionNmap Arbitrary File Write Vulnerability. CVE-2013-4885. Remote exploit for linux platform
idEDB-ID:38741
last seen2016-02-04
modified2013-08-06
published2013-08-06
reporterPiotr Duszynski
sourcehttps://www.exploit-db.com/download/38741/
titleNmap Arbitrary File Write Vulnerability

Nessus

  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2013-776.NASL
    descriptionnmap was updated to fix the http-domino-enum-passwords scripts. If you ran the (fortunately non-default) http-domino-enum-passwords script with the (fortunately also non-default) domino-enum-passwords.idpath parameter against a malicious server, it could cause an arbitrarily named file to to be written to the client system.
    last seen2020-06-05
    modified2014-06-13
    plugin id75171
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/75171
    titleopenSUSE Security Update : nmap (openSUSE-SU-2013:1561-1)
  • NASL familySolaris Local Security Checks
    NASL idSOLARIS11_NMAP_20140731.NASL
    descriptionThe remote Solaris system is missing necessary patches to address security updates : - The http-domino-enum-passwords.nse script in NMap before 6.40, when domino-enum-passwords.idpath is set, allows remote servers to upload
    last seen2020-06-01
    modified2020-06-02
    plugin id80710
    published2015-01-19
    reporterThis script is Copyright (C) 2015-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/80710
    titleOracle Solaris Third-Party Patch Update : nmap (cve_2013_4885_unrestricted_file)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2013-14786.NASL
    description - updated for 6.40 - fixes CVE-2013-4885 nmap: arbitrary file upload flaw in http-domino-enum-passwords NSE script Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-17
    modified2013-08-28
    plugin id69485
    published2013-08-28
    reporterThis script is Copyright (C) 2013-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/69485
    titleFedora 18 : nmap-6.40-1.fc18 (2013-14786)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2013-790.NASL
    descriptionnmap was updated to fix bnc#844953/CVE-2013-4885: There was a vulnerability in one of our 437 NSE scripts. If you ran the (fortunately non-default) http-domino-enum-passwords script with the (fortunately also non-default) domino-enum-passwords.idpath parameter against a malicious server, it could cause an arbitrarily named file to to be written to the client system.
    last seen2020-06-05
    modified2014-06-13
    plugin id75175
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/75175
    titleopenSUSE Security Update : nmap (openSUSE-SU-2013:1579-1)
  • NASL familyAmazon Linux Local Security Checks
    NASL idALA_ALAS-2016-671.NASL
    descriptionThe http-domino-enum-passwords.nse script in NMap before 6.40, when domino-enum-passwords.idpath is set, allows remote servers to upload arbitrarily named files via a crafted FullName parameter in a response, as demonstrated using directory traversal sequences.
    last seen2020-06-01
    modified2020-06-02
    plugin id90100
    published2016-03-23
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/90100
    titleAmazon Linux AMI : nmap (ALAS-2016-671)

Seebug

bulletinFamilyexploit
descriptionBUGTRAQ ID: 62024 CVE(CAN) ID: CVE-2013-4885 nmap是一款用于网络发现（Network Discovery）和安全审计（Security Auditing）的网络安全工具，它是自由软件。 Nmap 6.25在http-domino-enum-passwords NSE脚本内存在任意文件上传漏洞，攻击者可利用此漏洞以当前用户权限写任意文件。 0 Nmap 6.25 厂商补丁： Nmap ---- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://nmap.org/download.html
idSSV:60988
last seen2017-11-19
modified2013-09-03
published2013-09-03
reporterRoot
sourcehttps://www.seebug.org/vuldb/ssvid-60988
titleNmap 任意文件写漏洞(CVE-2013-4885）

References