CVE-2019-9146

CVE-2019-9146 describes a man-in-the-middle vulnerability in Jamf Self Service version 10.9.0. An attacker can exploit the "publish Bash shell scripts" feature to inject malicious commands into the TCP data stream, specifically by inserting a path to the Terminal application. This allows the attacker to obtain a root shell on the affected system. The vulnerability has a CVSS score of 7.5 (HIGH), indicating a high severity due to its network-adjacent attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. There is currently no known active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.