PT-2018-13954 · Nmap · Nmap4J

Zhutougg · Published 2018-09-19 · Updated 2019-10-03 · CVE-2018-17228

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions nmap4j version 1.1.0

Description The issue allows attackers to execute arbitrary commands via shell metacharacters in an includeHosts call.

Recommendations For nmap4j version 1.1.0, consider restricting the use of the includeHosts call until a patch is available to prevent the execution of arbitrary commands.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2018-17228

Affected Products

Nmap4J

References · 3

• 🔥 https://github.com/narkisr/nmap4j/issues/9 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-17228 · Security Note
• https://osv.dev/vulnerability/CVE-2018-17228 · Vendor Advisory