Public Date:
995634: CVE-2013-4885 nmap: arbitrary file upload flaw in http-domino-enum-passwords NSE script

The MITRE CVE dictionary describes this issue as:

The http-domino-enum-passwords.nse script in NMap before 6.40, when domino-enum-passwords.idpath is set, allows remote servers to upload "arbitrarily named" files via a crafted FullName parameter in a response, as demonstrated using directory traversal sequences.

Find out more about CVE-2013-4885 from the MITRE CVE dictionary dictionary and NIST NVD.


This did not affect the version of nmap as shipped with Red Hat Enterprise Linux 5, as it did not have support for NSE scripts. This issue affects the version of nmap as shipped with Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw.

CVSS v2 metrics

NOTE: The following CVSS v2 metrics and score provided are preliminary and subject to review.

Base Score 2.6
Base Metrics AV:N/AC:H/Au:N/C:N/I:P/A:N
Access Vector Network
Access Complexity High
Authentication None
Confidentiality Impact None
Integrity Impact Partial
Availability Impact None

Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).

Affected Packages State

Platform Package State
Red Hat Enterprise Linux 7 nmap Not affected
Red Hat Enterprise Linux 6 nmap Will not fix
Red Hat Enterprise Linux 5 nmap Not affected
Last Modified

CVE description copyright © 2017, The MITRE Corporation