MEDIUM🇵🇱 Wersja polska

CVE-2020-35208

CVSS 5.7v3.1pub. 2020-12-12upd. 2024-11-21

An issue was discovered in the LogMein LastPass Password Manager (aka com.lastpass.ilastpass) app 4.8.11.2403 for iOS. The password authentication for unlocking can be bypassed by forcing the authentication result to be true through runtime manipulation. In other words, an attacker could authenticate with an arbitrary password. NOTE: the vendor has indicated that this is not an attack of interest within the context of their threat model, which excludes jailbroken devices

CVSS Vector
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

  • Logmein Lastpass

    APP
    Logmein
    4.8.11.2403
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Auth Bypass
CWE
References

Related vulnerabilities

CVE-2019-16371HIGH8.2same product

LogMeIn LastPass before 4.33.0 allows attackers to construct a crafted web site that captures the credentials ...

CVE-2018-10193HIGH7.5same product

LogMeIn LastPass through 4.15.0 allows remote attackers to cause a denial of service (browser hang) via an HTM...

CVE-2020-35207MEDIUM5.7same product

An issue was discovered in the LogMein LastPass Password Manager (aka com.lastpass.ilastpass) app 4.8.11.2403 ...

CVE-2013-5113MEDIUM6.8same product

LastPass prior to 2.5.1 has an insecure PIN implementation.

CVE-2013-5114MEDIUM6.1same product

LastPass prior to 2.5.1 allows secure wipe bypass.