PT-2020-9867 · Jamf · Jamf Pro

Published 2020-01-08 · Updated 2020-01-13 · CVE-2019-17076

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jamf Pro versions 9.x through 10.15.0

Description An issue was discovered that allows deserialization of untrusted data when parsing JSON in several APIs, which may cause Denial of Service (DoS), remote code execution (RCE), and/or deletion of files on the Jamf Pro server.

Recommendations For Jamf Pro versions 9.x through 10.15.0, update to version 10.15.1 or later to resolve the issue.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2019-17076

Affected Products

Jamf Pro

References · 3

• https://resources.jamf.com/documents/products/security-disclosure-notice-jamf-pro-10.15.1.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-17076 · Security Note
• https://osv.dev/vulnerability/CVE-2019-17076 · Vendor Advisory