CVE-2020-35208

** DISPUTED ** An issue was discovered in the LogMein LastPass Password Manager (aka com.lastpass.ilastpass) app 4.8.11.2403 for iOS. The password authentication for unlocking can be bypassed by forcing the authentication result to be true through runtime manipulation. In other words, an attacker could authenticate with an arbitrary password. NOTE: the vendor has indicated that this is not an attack of interest within the context of their threat model, which excludes jailbroken devices.
References
Link Resource
https://github.com/evilblazer/LastPassVulnerabilities Exploit Third Party Advisory
https://youtu.be/63PfHVSr8iw Exploit Third Party Advisory
Advertisement

NeevaHost hosting service

Configurations

Configuration 1 (hide)

cpe:2.3:a:logmein:lastpass:4.8.11.2403:*:*:*:*:iphone_os:*:*

Information

Published : 2020-12-12 11:15

Updated : 2020-12-15 11:18


NVD link : CVE-2020-35208

Mitre link : CVE-2020-35208


JSON object : View

CWE
CWE-287

Improper Authentication

Advertisement

dedicated server usa

Products Affected

logmein

  • lastpass