PT-2020-17293 · Logmein · Logmein Lastpass Password Manager

Published 2020-12-12 · Updated 2024-08-04 · CVE-2020-35208

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions LogMein LastPass Password Manager version 4.8.11.2403

Description An issue was discovered in the LogMein LastPass Password Manager app for iOS, where the password authentication for unlocking can be bypassed by forcing the authentication result to be true through runtime manipulation, allowing an attacker to authenticate with an arbitrary password. The vendor has indicated that this is not an attack of interest within the context of their threat model, which excludes jailbroken devices.

Recommendations For version 4.8.11.2403, as a temporary workaround, consider implementing additional authentication measures to minimize the risk of exploitation, such as requiring a second form of verification. However, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2020-35208

Affected Products

Logmein Lastpass Password Manager

References · 5

• 🔥 https://github.com/evilblazer/LastPassVulnerabilities · Exploit
• 🔥 https://youtu.be/63PfHVSr8iw · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-35208 · Security Note
• https://osv.dev/vulnerability/CVE-2020-35208 · Vendor Advisory
• https://t.me/cvenotify/89038 · Telegram Post