CVE-2021-35037

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-07-12 · updated 2026-06-17
Weakness: CWE-601

Description

Jamf Pro before 10.30.1 allows for an unvalidated URL redirect vulnerability affecting Jamf Pro customers who host their environments on-premises. An attacker may craft a URL that appears to be for a customer's Jamf Pro instance, but when clicked will forward a user to an arbitrary URL that may be malicious. This is tracked via Jamf with the following ID: PI-009822

Affected products

Jamf: before 10.30.1 — fixed in 10.30.1

How to fix

Upgrade to a fixed version: Jamf 10.30.1. Check the vendor advisory for mitigations.

References

https://www.jamf.com/jamf-nation/discussions/39219/jamf-pro-10-30-1-security-upgrade
https://www.jamf.com/resources/product-documentation/jamf-pro-release-notes/
https://www.jamf.com/jamf-nation/discussions/39219/jamf-pro-10-30-1-security-upgrade
https://www.jamf.com/resources/product-documentation/jamf-pro-release-notes/

Get alerted when CVE-2021-35037 or the next vulnerability affects your stack