Vulnerability · Published Jun 27, 2024 · Assigned by JAMF
CVE-2024-4395Lack of Client Validation in Jamf Compliance Editor's Helper Service May Result in Privilege Escalation
High 7.8
In plain English
A high-severity privilege mismanagement in Jamf Compliance Editor from JAMF. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 88.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The XPC service within the audit functionality of Jamf Compliance Editor before version 1.3.1 on macOS can lead to local privilege escalation.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| JAMF | Jamf Compliance Editor | 1 – before 1.3.1 |
Weakness: CWE-269 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://khronokernel.com/macos/2024/05/01/CVE-2024-4395.html technical-description, third-party-advisory
- https://github.com/Jamf-Concepts/jamf-compliance-editor/raw/v1.3.1/Jamf%20Compliance%20Editor%20-%20User%20Guide.pdf vendor-advisory, release-notes
- https://trusted.jamf.com/docs/establishing-compliance-baselines#support product, patch
- https://github.com/Jamf-Concepts/jamf-compliance-editor/releases/download/v1.3.1/JamfComplianceEditor.v1.3.1.pkg patch