PT-2018-19267 · Nmap · Nmap

Published 2018-04-06 · Updated 2018-04-06

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Nmap versions (affected versions not specified)

Description A security flaw was discovered in the http-fetch script of Nmap, which is a directory traversal vulnerability. This issue allows a malicious web server to potentially save files outside the intended destination directory if a user manually runs the NSE script against it. However, existing files cannot be overwritten. The issue was addressed by fixing the http-fetch script, auditing other scripts for similar mistakes, and updating the httpspider library API to provide default protection against this vulnerability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

MGASA-2018-0196

Affected Products

Nmap

References · 4

• https://osv.dev/vulnerability/MGASA-2018-0196 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0196.html · Security Note
• https://bugs.mageia.org/show_bug.cgi?id=22854 · Note
• http://seclists.org/nmap-announce/2018/0 · Note