CVE-2020-35207
Last modified
CVE-2020-35207 is a medium-severity vulnerability rated 5.7/10 on the CVSS scale. An issue was discovered in the LogMein LastPass Password Manager (aka com.lastpass.ilastpass) app 4.8.11.2403 for iOS. The PIN authentication for unlocking can be bypassed by forcing the authentication result to be true through runtime manipulation. EPSS estimates a 0.47% chance of exploitation in the next 30 days.
Description
An issue was discovered in the LogMein LastPass Password Manager (aka com.lastpass.ilastpass) app 4.8.11.2403 for iOS. The PIN authentication for unlocking can be bypassed by forcing the authentication result to be true through runtime manipulation. In other words, an attacker could authenticate with an arbitrary PIN. NOTE: the vendor has indicated that this is not an attack of interest within the context of their threat model, which excludes jailbroken devices
Metrics
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Logmein | Lastpass | 4.8.11.2403 |
References
- https://github.com/evilblazer/LastPassVulnerabilitiesExploit, Third Party Advisory
- https://youtu.be/C5j7drIylsQExploit, Third Party Advisory
- https://github.com/evilblazer/LastPassVulnerabilitiesExploit, Third Party Advisory
- https://youtu.be/C5j7drIylsQExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-35207?
How severe is CVE-2020-35207?
How do I fix CVE-2020-35207?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-35201Ignite Realtime Openfire 4.6.0 has create-bookmark.jsp users…5.4
- CVE-2020-35202Ignite Realtime Openfire 4.6.0 has plugins/dbaccess/db-acces…5.4
- CVE-2020-35203Reflected XSS in Web Compliance Manager in Quest Policy Auth…6.1
- CVE-2020-35204Reflected XSS in Quest Policy Authority version 8.1.2.200 al…6.1
- CVE-2020-35205Server Side Request Forgery (SSRF) in Web Compliance Manager…9.8
- CVE-2020-35206Reflected XSS in Web Compliance Manager in Quest Policy Auth…6.1
- CVE-2020-35208An issue was discovered in the LogMein LastPass Password Man…5.7
- CVE-2020-35209An issue in Atomix v3.1.5 allows unauthorized Atomix nodes t…7.5
- CVE-2020-3521A vulnerability in a specific REST API of Cisco Data Center …6.5
- CVE-2020-35210A vulnerability in Atomix v3.1.5 allows attackers to cause a…6.5
- CVE-2020-35211An issue in Atomix v3.1.5 allows unauthorized Atomix nodes t…7.5
- CVE-2020-35213An issue in Atomix v3.1.5 allows attackers to cause a denial…8.1
Are you affected by CVE-2020-35207?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST