MEDIUM🇵🇱 Wersja polska

CVE-2020-35208

CVSS 5.7v3.1pub. 2020-12-12upd. 2024-11-21

An issue was discovered in the LogMein LastPass Password Manager (aka com.lastpass.ilastpass) app 4.8.11.2403 for iOS. The password authentication for unlocking can be bypassed by forcing the authentication result to be true through runtime manipulation. In other words, an attacker could authenticate with an arbitrary password. NOTE: the vendor has indicated that this is not an attack of interest within the context of their threat model, which excludes jailbroken devices

CVSS Vector
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

  • Logmein Lastpass

    APP
    Logmein
    4.8.11.2403
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Auth Bypass
CWE
References

Related vulnerabilities

CVE-2019-16371HIGH8.2ten sam produkt

LogMeIn LastPass before 4.33.0 allows attackers to construct a crafted web site that captures the credentials ...

CVE-2018-10193HIGH7.5ten sam produkt

LogMeIn LastPass through 4.15.0 allows remote attackers to cause a denial of service (browser hang) via an HTM...

CVE-2020-35207MEDIUM5.7ten sam produkt

An issue was discovered in the LogMein LastPass Password Manager (aka com.lastpass.ilastpass) app 4.8.11.2403 ...

CVE-2013-5113MEDIUM6.8ten sam produkt

LastPass prior to 2.5.1 has an insecure PIN implementation.

CVE-2013-5114MEDIUM6.1ten sam produkt

LastPass prior to 2.5.1 allows secure wipe bypass.