CVE-2020-35207

MEDIUM

Logmein Lastpass - Authentication Bypass

Title source: rule
STIX 2.1

Description

An issue was discovered in the LogMein LastPass Password Manager (aka com.lastpass.ilastpass) app 4.8.11.2403 for iOS. The PIN authentication for unlocking can be bypassed by forcing the authentication result to be true through runtime manipulation. In other words, an attacker could authenticate with an arbitrary PIN. NOTE: the vendor has indicated that this is not an attack of interest within the context of their threat model, which excludes jailbroken devices

References (2)

Core 2
Core References
Exploit, Third Party Advisory x_refsource_misc
https://youtu.be/C5j7drIylsQ

Scores

CVSS v3 5.7
EPSS 0.0003
EPSS Percentile 10.3%
Attack Vector PHYSICAL
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Details

CWE
CWE-287
Status published
Products (1)
logmein/lastpass 4.8.11.2403
Published Dec 12, 2020
Tracked Since Feb 18, 2026