PT-2020-17292 · Logmein · Logmein Lastpass Password Manager

Published 2020-12-12 · Updated 2024-08-04 · CVE-2020-35207

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions LogMein LastPass Password Manager version 4.8.11.2403

Description An issue was discovered in the LogMein LastPass Password Manager app for iOS, where the PIN authentication for unlocking can be bypassed by forcing the authentication result to be true through runtime manipulation, allowing an attacker to authenticate with an arbitrary PIN. The vendor has indicated that this is not an attack of interest within the context of their threat model, which excludes jailbroken devices.

Recommendations For version 4.8.11.2403, as a temporary workaround, consider implementing additional security measures to prevent runtime manipulation, such as restricting access to sensitive data or using alternative authentication methods. However, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2020-35207

Affected Products

Logmein Lastpass Password Manager

References · 5

• 🔥 https://github.com/evilblazer/LastPassVulnerabilities · Exploit
• 🔥 https://youtu.be/C5j7drIylsQ · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-35207 · Security Note
• https://osv.dev/vulnerability/CVE-2020-35207 · Vendor Advisory
• https://t.me/cvenotify/89037 · Telegram Post