CVE-2013-4885

Exp

The http-domino-enum-passwords.nse script in NMap before 6.40, when domino-enum-passwords.idpath is set, allows remote servers to upload "arbitrarily named" files via a crafted FullName parameter in a response, as demonstrated using directory traversal sequences.

Published: 2013-10-26 Last update: 2026-04-29 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2013-4885 is rated High Exploit Risk (73.4/100): CVSS Medium severity, with high exploitation likelihood (EPSS 6.43%, 91th percentile). 4 public exploit reference(s) are indexed (Exploit-DB). Public exploits are available—assess exposure, apply mitigations, and prioritize patching.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Public exploit references (Exploit-DB) for CVE-2013-4885

EDB-ID Source Kind Published Link
38741 exploit_db edb 2013-08-06 Exploit-DB ↗
— nvd_ref exploit_tag Exploit-DB ↗
— nvd_ref exploit_tag Exploit-DB ↗
— nvd_ref exploit_tag Exploit-DB ↗

Exploit prediction scoring system (EPSS) score for CVE-2013-4885

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2025-06-11 6.88% 6.43% -0.46%
2 2025-03-30 18.82% 6.88% -11.93%
3 2025-03-29 — 18.82% —

Full EPSS history (12 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2013-4885

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
6.8 2.0 MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P Click to expand
Access vector (AV:N)
Can be exploited remotely over network reachability.
Access complexity (AC:M)
Exploitation needs some favorable conditions, but not exceptional ones.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:P)
Partial confidentiality impact.
Integrity impact (I:P)
Partial integrity impact.
Availability impact (A:P)
Partial availability impact.
 8.6 6.4 [email protected]

Weakness enumeration for CVE-2013-4885

OS Trackers for CVE-2013-4885

vendor priority summary link
debian low CVE-2013-4885 low priority: Debian including 1 source packages (nmap), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. https://security-tracker.debian.org/tracker/CVE-2013-4885
redhat low — https://access.redhat.com/security/cve/CVE-2013-4885
ubuntu low CVE-2013-4885 low priority: Ubuntu including 1 source packages (nmap), 7 status rows across 7 suites (lucid, precise, quantal, raring, saucy, trusty, upstream): ignored 3, released 3, not-affected 1. https://ubuntu.com/security/CVE-2013-4885

NVD evaluator notes for CVE-2013-4885

Comment: CWE-434: Unrestricted Upload of File with Dangerous Type per http://cwe.mitre.org/data/definitions/434.html

Affected software / configurations for CVE-2013-4885

Vendor Product Version Raw CPE
nmap nmap <= 6.25 cpe:2.3:a:nmap:nmap:*:*:*:*:*:*:*:*
nmap nmap 2.1 cpe:2.3:a:nmap:nmap:2.1:beta1:*:*:*:*:*:*
nmap nmap 2.2 cpe:2.3:a:nmap:nmap:2.2:beta2:*:*:*:*:*:*
nmap nmap 2.2 cpe:2.3:a:nmap:nmap:2.2:beta3:*:*:*:*:*:*
nmap nmap 2.2 cpe:2.3:a:nmap:nmap:2.2:beta4:*:*:*:*:*:*
nmap nmap 2.3 cpe:2.3:a:nmap:nmap:2.3:beta10:*:*:*:*:*:*
nmap nmap 2.3 cpe:2.3:a:nmap:nmap:2.3:beta12:*:*:*:*:*:*
nmap nmap 2.3 cpe:2.3:a:nmap:nmap:2.3:beta13:*:*:*:*:*:*
nmap nmap 2.3 cpe:2.3:a:nmap:nmap:2.3:beta14:*:*:*:*:*:*
nmap nmap 2.3 cpe:2.3:a:nmap:nmap:2.3:beta17:*:*:*:*:*:*
nmap nmap 2.3 cpe:2.3:a:nmap:nmap:2.3:beta18:*:*:*:*:*:*
nmap nmap 2.3 cpe:2.3:a:nmap:nmap:2.3:beta19:*:*:*:*:*:*
nmap nmap 2.3 cpe:2.3:a:nmap:nmap:2.3:beta20:*:*:*:*:*:*
nmap nmap 2.3 cpe:2.3:a:nmap:nmap:2.3:beta21:*:*:*:*:*:*
nmap nmap 2.3 cpe:2.3:a:nmap:nmap:2.3:beta4:*:*:*:*:*:*
nmap nmap 2.3 cpe:2.3:a:nmap:nmap:2.3:beta5:*:*:*:*:*:*
nmap nmap 2.3 cpe:2.3:a:nmap:nmap:2.3:beta6:*:*:*:*:*:*
nmap nmap 2.3 cpe:2.3:a:nmap:nmap:2.3:beta8:*:*:*:*:*:*
nmap nmap 2.3 cpe:2.3:a:nmap:nmap:2.3:beta9:*:*:*:*:*:*
nmap nmap 2.05 cpe:2.3:a:nmap:nmap:2.05:*:*:*:*:*:*:*
nmap nmap 2.06 cpe:2.3:a:nmap:nmap:2.06:*:*:*:*:*:*:*
nmap nmap 2.07 cpe:2.3:a:nmap:nmap:2.07:*:*:*:*:*:*:*
nmap nmap 2.08 cpe:2.3:a:nmap:nmap:2.08:*:*:*:*:*:*:*
nmap nmap 2.09 cpe:2.3:a:nmap:nmap:2.09:*:*:*:*:*:*:*
nmap nmap 2.10 cpe:2.3:a:nmap:nmap:2.10:*:*:*:*:*:*:*
nmap nmap 2.11 cpe:2.3:a:nmap:nmap:2.11:*:*:*:*:*:*:*
nmap nmap 2.12 cpe:2.3:a:nmap:nmap:2.12:*:*:*:*:*:*:*
nmap nmap 2.50 cpe:2.3:a:nmap:nmap:2.50:*:*:*:*:*:*:*
nmap nmap 2.51 cpe:2.3:a:nmap:nmap:2.51:*:*:*:*:*:*:*
nmap nmap 2.52 cpe:2.3:a:nmap:nmap:2.52:*:*:*:*:*:*:*
nmap nmap 2.53 cpe:2.3:a:nmap:nmap:2.53:*:*:*:*:*:*:*
nmap nmap 2.54 cpe:2.3:a:nmap:nmap:2.54:beta1:*:*:*:*:*:*
nmap nmap 2.54 cpe:2.3:a:nmap:nmap:2.54:beta16:*:*:*:*:*:*
nmap nmap 2.54 cpe:2.3:a:nmap:nmap:2.54:beta19:*:*:*:*:*:*
nmap nmap 2.54 cpe:2.3:a:nmap:nmap:2.54:beta2:*:*:*:*:*:*
nmap nmap 2.54 cpe:2.3:a:nmap:nmap:2.54:beta20:*:*:*:*:*:*
nmap nmap 2.54 cpe:2.3:a:nmap:nmap:2.54:beta21:*:*:*:*:*:*
nmap nmap 2.54 cpe:2.3:a:nmap:nmap:2.54:beta22:*:*:*:*:*:*
nmap nmap 2.54 cpe:2.3:a:nmap:nmap:2.54:beta24:*:*:*:*:*:*
nmap nmap 2.54 cpe:2.3:a:nmap:nmap:2.54:beta25:*:*:*:*:*:*
nmap nmap 2.54 cpe:2.3:a:nmap:nmap:2.54:beta26:*:*:*:*:*:*
nmap nmap 2.54 cpe:2.3:a:nmap:nmap:2.54:beta27:*:*:*:*:*:*
nmap nmap 2.54 cpe:2.3:a:nmap:nmap:2.54:beta28:*:*:*:*:*:*
nmap nmap 2.54 cpe:2.3:a:nmap:nmap:2.54:beta29:*:*:*:*:*:*
nmap nmap 2.54 cpe:2.3:a:nmap:nmap:2.54:beta3:*:*:*:*:*:*
nmap nmap 2.54 cpe:2.3:a:nmap:nmap:2.54:beta30:*:*:*:*:*:*
nmap nmap 2.54 cpe:2.3:a:nmap:nmap:2.54:beta31:*:*:*:*:*:*
nmap nmap 2.54 cpe:2.3:a:nmap:nmap:2.54:beta32:*:*:*:*:*:*
nmap nmap 2.54 cpe:2.3:a:nmap:nmap:2.54:beta33:*:*:*:*:*:*
nmap nmap 2.54 cpe:2.3:a:nmap:nmap:2.54:beta34:*:*:*:*:*:*
nmap nmap 2.54 cpe:2.3:a:nmap:nmap:2.54:beta35:*:*:*:*:*:*
nmap nmap 2.54 cpe:2.3:a:nmap:nmap:2.54:beta36:*:*:*:*:*:*
nmap nmap 2.54 cpe:2.3:a:nmap:nmap:2.54:beta37:*:*:*:*:*:*
nmap nmap 2.54 cpe:2.3:a:nmap:nmap:2.54:beta4:*:*:*:*:*:*
nmap nmap 2.54 cpe:2.3:a:nmap:nmap:2.54:beta5:*:*:*:*:*:*
nmap nmap 2.54 cpe:2.3:a:nmap:nmap:2.54:beta6:*:*:*:*:*:*
nmap nmap 2.54 cpe:2.3:a:nmap:nmap:2.54:beta7:*:*:*:*:*:*
nmap nmap 2.99 cpe:2.3:a:nmap:nmap:2.99:rc1:*:*:*:*:*:*
nmap nmap 2.99 cpe:2.3:a:nmap:nmap:2.99:rc2:*:*:*:*:*:*
nmap nmap 3.00 cpe:2.3:a:nmap:nmap:3.00:*:*:*:*:*:*:*
nmap nmap 3.10 cpe:2.3:a:nmap:nmap:3.10:alpha1:*:*:*:*:*:*
nmap nmap 3.10 cpe:2.3:a:nmap:nmap:3.10:alpha2:*:*:*:*:*:*
nmap nmap 3.10 cpe:2.3:a:nmap:nmap:3.10:alpha3:*:*:*:*:*:*
nmap nmap 3.10 cpe:2.3:a:nmap:nmap:3.10:alpha4:*:*:*:*:*:*
nmap nmap 3.10 cpe:2.3:a:nmap:nmap:3.10:alpha5:*:*:*:*:*:*
nmap nmap 3.10 cpe:2.3:a:nmap:nmap:3.10:alpha7:*:*:*:*:*:*
nmap nmap 3.10 cpe:2.3:a:nmap:nmap:3.10:alpha9:*:*:*:*:*:*
nmap nmap 3.15 cpe:2.3:a:nmap:nmap:3.15:beta1:*:*:*:*:*:*
nmap nmap 3.15 cpe:2.3:a:nmap:nmap:3.15:beta2:*:*:*:*:*:*
nmap nmap 3.15 cpe:2.3:a:nmap:nmap:3.15:beta3:*:*:*:*:*:*
nmap nmap 3.20 cpe:2.3:a:nmap:nmap:3.20:*:*:*:*:*:*:*
nmap nmap 3.25 cpe:2.3:a:nmap:nmap:3.25:*:*:*:*:*:*:*
nmap nmap 3.26 cpe:2.3:a:nmap:nmap:3.26:*:*:*:*:*:*:*
nmap nmap 3.27 cpe:2.3:a:nmap:nmap:3.27:*:*:*:*:*:*:*
nmap nmap 3.28 cpe:2.3:a:nmap:nmap:3.28:*:*:*:*:*:*:*
nmap nmap 3.30 cpe:2.3:a:nmap:nmap:3.30:*:*:*:*:*:*:*
nmap nmap 3.40 cpe:2.3:a:nmap:nmap:3.40:pvt1:*:*:*:*:*:*
nmap nmap 3.40 cpe:2.3:a:nmap:nmap:3.40:pvt10:*:*:*:*:*:*
nmap nmap 3.40 cpe:2.3:a:nmap:nmap:3.40:pvt11:*:*:*:*:*:*
nmap nmap 3.40 cpe:2.3:a:nmap:nmap:3.40:pvt12:*:*:*:*:*:*

References for CVE-2013-4885

cvelogic Threat Intelligence