PT-2020-8514 · Jamf · Jamf Pro

Published 2020-01-07 · Updated 2020-08-24 · CVE-2018-10465

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Jamf Pro versions prior to 10.3.0

Description: The issue concerns incorrect access control, where Jamf Pro user accounts and groups with login access to Jamf Pro have full access to endpoints in the Universal API (UAPI), regardless of their privileges. This allows an authenticated account without required privileges to perform CRUD actions (GET, POST, PUT, DELETE) on UAPI endpoints, potentially leading to unauthorized information disclosure, compromised data integrity, and data loss. The available UAPI endpoints and associated CRUD actions can be found at the "/uapi/doc" endpoint in a Jamf Pro instance.

Recommendations: For Jamf Pro versions prior to 10.3.0, update to version 10.3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the UAPI endpoints to minimize the risk of exploitation. Avoid using accounts without required privileges to access the UAPI until the issue is resolved.

Fix

Related Identifiers

CVE-2018-10465

Affected Products

Jamf Pro

References · 3

• https://osv.dev/vulnerability/CVE-2018-10465 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-10465 · Security Note
• https://docs.jamf.com/10.3.0/jamf-pro/release-notes/Bug_Fixes_and_Enhancements.html · Vendor Advisory