CVE-2019-9146
Jamf Self Service 10.9.0 allows man-in-the-middle attackers to obtain a root shell by leveraging...
CVE-2019-9146 is a high vulnerability (CVSS 7.5) in Jamf Self Service, published February 25, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.78%, the 55th percentile. No source names a fixed version.
Jamf Self Service 10.9.0 allows man-in-the-middle attackers to obtain a root shell by leveraging the "publish Bash shell scripts" feature to insert "/Applications/Utilities/Terminal app/Contents/MacOS/Terminal" into the TCP data stream.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Jamf Self Service 10.9.0 allows man-in-the-middle attackers to obtain a root shell by leveraging the "publish Bash shell scripts" feature to insert "/Applications/Utilities/Terminal app/Contents/MacOS/Terminal" into the TCP data stream.
- Record
CVE-2019-9146- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.9 High
AV:A/AC:M/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
Jamf Self Service 10.9.0 allows man-in-the-middle attackers to obtain a root shell by leveraging the "publish Bash shell scripts" feature to insert "/Applications/Utilities/Terminal app/Contents/MacOS/Terminal" into the TCP data stream.
- Record
CVE-2019-9146- Updated
- 2026-11-02
EUVDEUVD-2019-18527 No score
Jamf Self Service 10.9.0 allows man-in-the-middle attackers to obtain a root shell by leveraging the "publish Bash shell scripts" feature to insert "/Applications/Utilities/Terminal app/Contents/MacOS/Terminal" into the TCP data stream.
- Record
EUVD-2019-18527- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3r7r-62rh-7p3r
Jamf Self Service 10.9.0 allows man-in-the-middle attackers to obtain a root shell by leveraging...
Jamf Self Service 10.9.0 allows man-in-the-middle attackers to obtain a root shell by leveraging the "publish Bash shell scripts" feature to insert "/Applications/Utilities/Terminal app/Contents/MacOS/Terminal" into the TCP data stream.
- Record
GHSA-3r7r-62rh-7p3r- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD |