Incorrect Access Control in Jamf Pro by Jamf
CVE-2018-10465

8.8HIGH

Key Information:

Vendor

Jamf

Status
Jamf
Vendor
CVE Published:
7 January 2020

What is CVE-2018-10465?

Jamf Pro versions prior to 10.3.0 exhibit an incorrect access control vulnerability that allows authenticated users—regardless of their privileges—to perform CRUD operations on Universal API (UAPI) endpoints. This flaw could lead to unauthorized information disclosure, data integrity issues, and potential data loss. Users with limited access rights might exploit this vulnerability to manipulate data in ways that exceed their authorized capabilities, posing a significant risk to the security of endpoints managed by Jamf Pro.

References

https://docs.jamf.com/10.3.0/jamf-pro/release-notes/Bug_F...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.