CVE-2018-1000161: Path Traversal

Published Apr 18, 2018

Updated

nmap version 6.49BETA6 through 7.60, up to and including SVN revision 37147 contains a Directory Traversal vulnerability in NSE script http-fetch that can result in file overwrite as the user is running it. This attack appears to be exploitable via a victim that runs NSE script http-fetch against a malicious web site. This vulnerability appears to have been fixed in 7.7.

Affected Software

13 affected components

Nmap Nmap=6.49-beta6

Nmap Nmap=7.00

Nmap Nmap=7.01

Nmap Nmap=7.10

Nmap Nmap=7.11

Nmap Nmap=7.12

Nmap Nmap=7.25-beta1

Nmap Nmap=7.25-beta2

Nmap Nmap=7.30

Nmap Nmap=7.31

Nmap Nmap=7.40

Nmap Nmap=7.50

Nmap Nmap=7.60

Event History

Apr 18, 2018

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2018-1000161?

CVE-2018-1000161 is classified as a critical severity vulnerability due to its potential for file overwrite during scripting execution.

How do I fix CVE-2018-1000161?

To fix CVE-2018-1000161, upgrade your Nmap installation to version 7.70 or later.

Which versions of Nmap are affected by CVE-2018-1000161?

CVE-2018-1000161 affects Nmap versions from 6.49BETA6 to 7.60.

What kind of vulnerability is CVE-2018-1000161?

CVE-2018-1000161 is a directory traversal vulnerability associated with the http-fetch NSE script.

Can CVE-2018-1000161 be exploited remotely?

Yes, CVE-2018-1000161 can be exploited if a victim runs the affected NSE script in an open and vulnerable environment.