CVE-2020-35207

{"id": "CVE-2020-35207", "cveTags": [{"tags": ["disputed"], "sourceIdentifier": "cve@mitre.org"}], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.3, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 0.5}]}, "published": "2020-12-12T19:15:11.653", "references": [{"url": "https://github.com/evilblazer/LastPassVulnerabilities", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://youtu.be/C5j7drIylsQ", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/evilblazer/LastPassVulnerabilities", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://youtu.be/C5j7drIylsQ", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in the LogMein LastPass Password Manager (aka com.lastpass.ilastpass) app 4.8.11.2403 for iOS. The PIN authentication for unlocking can be bypassed by forcing the authentication result to be true through runtime manipulation. In other words, an attacker could authenticate with an arbitrary PIN. NOTE: the vendor has indicated that this is not an attack of interest within the context of their threat model, which excludes jailbroken devices"}, {"lang": "es", "value": "** EN DISPUTA ** Se detect\u00f3 un problema en la aplicaci\u00f3n LogMein LastPass Password Manager (tambi\u00e9n se conoce como com.lastpass.ilastpass) 4.8.11.2403 para iOS. La autenticaci\u00f3n de PIN para el desbloqueo se puede omitir al forzar que el resultado de la autenticaci\u00f3n sea verdadero mediante la manipulaci\u00f3n del tiempo de ejecuci\u00f3n. En otras palabras, un atacante podr\u00eda autenticarse con un PIN arbitrario. NOTA: el proveedor ha indicado que este no es un ataque de inter\u00e9s dentro del contexto de su modelo de amenaza, que excluye los dispositivos con jailbreak"}], "lastModified": "2024-11-21T05:26:58.933", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:logmein:lastpass:4.8.11.2403:*:*:*:*:iphone_os:*:*", "vulnerable": true, "matchCriteriaId": "B0EB5423-CBD2-4536-9DA3-A31A00791AA4"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}