MEDIUM🇬🇧 English

CVE-2020-35207

CVSS 5.7v3.1pub. 2020-12-12upd. 2024-11-21

An issue was discovered in the LogMein LastPass Password Manager (aka com.lastpass.ilastpass) app 4.8.11.2403 for iOS. The PIN authentication for unlocking can be bypassed by forcing the authentication result to be true through runtime manipulation. In other words, an attacker could authenticate with an arbitrary PIN. NOTE: the vendor has indicated that this is not an attack of interest within the context of their threat model, which excludes jailbroken devices

oryginał EN
CVSS Vector
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

  • Logmein Lastpass

    APP
    Logmein
    4.8.11.2403
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
Auth Bypass
CWE
Referencje

Powiązane podatności

CVE-2019-16371HIGH8.2ten sam produkt

LogMeIn LastPass before 4.33.0 allows attackers to construct a crafted web site that captures the credentials ...

CVE-2018-10193HIGH7.5ten sam produkt

LogMeIn LastPass through 4.15.0 allows remote attackers to cause a denial of service (browser hang) via an HTM...

CVE-2020-35208MEDIUM5.7ten sam produkt

An issue was discovered in the LogMein LastPass Password Manager (aka com.lastpass.ilastpass) app 4.8.11.2403 ...

CVE-2013-5113MEDIUM6.8ten sam produkt

LastPass prior to 2.5.1 has an insecure PIN implementation.

CVE-2013-5114MEDIUM6.1ten sam produkt

LastPass prior to 2.5.1 allows secure wipe bypass.

CVE-2020-35207 — MEDIUM 5.7 | CVEbaza.pl