CVE-2013-4885: Nmap

Medium severity, CVSS 6.8. EPSS: 7.2% chance of exploitation in the next 30 days.

The http-domino-enum-passwords.nse script in NMap before 6.40, when domino-enum-passwords.idpath is set, allows remote servers to upload "arbitrarily named" files via a crafted FullName parameter in a response, as demonstrated using directory traversal sequences.

Affected products

• Nmap Nmap: up to and including 6.25; version 2.1 only; version 2.2 only; version 2.3 only; version 2.05 only; version 2.06 only; …
• Opensuse Opensuse: version 12.3 only

Published 2013-10-26. Last modified 2026-06-16.