High · 7.3 CVE-2024-4395 EUVD-2024-44027GHSA-68wq-r58h-5q45

Lack of Client Validation in Jamf Compliance Editor's Helper Service May Result in Privilege Escalation

Published Jun 27, 2024 · Updated Aug 1, 2024 · Assigned by JAMF

Vendor: Jamf Product: Jamf Compliance Editor

Description

The XPC service within the audit functionality of Jamf Compliance Editor before version 1.3.1 on macOS can lead to local privilege escalation.

Affected products

Vendor	Product	Affected	Fixed
JAMF	Jamf Compliance Editor	1 – < 1.3.1	1.3.1

References

https://khronokernel.com/macos/2024/05/01/CVE-2024-4395.html technical-description third-party-advisory
https://github.com/Jamf-Concepts/jamf-compliance-editor/raw/v1.3.1/Jamf%20Compliance%20Editor%20-%20User%20Guide.pdf vendor-advisory release-notes
https://trusted.jamf.com/docs/establishing-compliance-baselines#support product patch
https://github.com/Jamf-Concepts/jamf-compliance-editor/releases/download/v1.3.1/JamfComplianceEditor.v1.3.1.pkg patch