Vulnerabilities > CVE-2019-16371 - Improper Restriction of Rendered UI Layers or Frames vulnerability in Logmein Lastpass

CVSS 8.2 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

LOW

Availability impact

NONE

network

low complexity

logmein

CWE-1021

NVD

Published: 2019-09-16

Updated: 2021-07-21

Summary

LogMeIn LastPass before 4.33.0 allows attackers to construct a crafted web site that captures the credentials for a victim's account on a previously visited web site, because do_popupregister can be bypassed via clickjacking.

Vulnerable Configurations

Part	Description	Count
Application	Logmein Logmein Lastpass 3.1.88 Logmein Lastpass 3.1.89 Logmein Lastpass 3.1.90 Logmein Lastpass 3.1.91 Logmein Lastpass 3.1.94 Logmein Lastpass 3.1.95 Logmein Lastpass 3.1.96 Logmein Lastpass 3.1.97 Logmein Lastpass 3.2.0 Logmein Lastpass 3.2.1 Logmein Lastpass 3.2.4 Logmein Lastpass 3.2.5 Logmein Lastpass 3.2.6 Logmein Lastpass 3.2.7 Logmein Lastpass 3.2.10 Logmein Lastpass 3.2.11 Logmein Lastpass 3.2.14 Logmein Lastpass 3.2.15 Logmein Lastpass 3.2.16 Logmein Lastpass 3.2.17 Logmein Lastpass 3.2.20 Logmein Lastpass 3.2.21 Logmein Lastpass 3.2.24 Logmein Lastpass 3.2.25 Logmein Lastpass 3.2.26 Logmein Lastpass 3.2.27 Logmein Lastpass 3.2.28 Logmein Lastpass 3.2.29 Logmein Lastpass 3.2.40 Logmein Lastpass 3.2.41 Logmein Lastpass 3.3.4 Logmein Lastpass 4.1.0-2 Logmein Lastpass 4.1.2 Logmein Lastpass 4.1.3 Logmein Lastpass 4.1.4 Logmein Lastpass 4.1.5 Logmein Lastpass 4.1.7 Logmein Lastpass 4.1.9 Logmein Lastpass 4.1.15 Logmein Lastpass 4.1.16 Logmein Lastpass 4.1.17 Logmein Lastpass 4.1.20 Logmein Lastpass 4.1.23 Logmein Lastpass 4.1.24 Logmein Lastpass 4.1.26 Logmein Lastpass 4.1.30 Logmein Lastpass 4.1.31 Logmein Lastpass 4.1.33 Logmein Lastpass 4.1.36 Logmein Lastpass 4.1.37 Logmein Lastpass 4.1.38 Logmein Lastpass 4.1.39 Logmein Lastpass 4.1.40 Logmein Lastpass 4.1.41 Logmein Lastpass 4.1.42 Logmein Lastpass 4.1.43 Logmein Lastpass 4.1.45 Logmein Lastpass 4.1.51 Logmein Lastpass 4.1.52 Logmein Lastpass 4.1.55 Logmein Lastpass 4.1.60 Logmein Lastpass 4.1.61 Logmein Lastpass 4.1.63 Logmein Lastpass 4.1.64 Logmein Lastpass 4.1.64A Logmein Lastpass 4.1.65 Logmein Lastpass 4.1.65A Logmein Lastpass 4.2.0 Logmein Lastpass 4.2.0A Logmein Lastpass 4.3.0 Logmein Lastpass 4.5.0 Logmein Lastpass 4.7.0 Logmein Lastpass 4.7.1 Logmein Lastpass 4.7.3 Logmein Lastpass 4.9.0 Logmein Lastpass 4.9.1 Logmein Lastpass 4.10.0 Logmein Lastpass 4.12.0 Logmein Lastpass 4.15.0 Logmein Lastpass 4.15.2 Logmein Lastpass 4.16.0 Logmein Lastpass 4.16.2 Logmein Lastpass 4.17.0 Logmein Lastpass 4.17.1 Logmein Lastpass 4.18.0 Logmein Lastpass 4.18.1 Logmein Lastpass 4.19.0 Logmein Lastpass 4.21.0 Logmein Lastpass 4.21.2 Logmein Lastpass 4.23.0 Logmein Lastpass 4.24.0 Logmein Lastpass 4.25.0 Logmein Lastpass 4.25.2 Logmein Lastpass 4.26.0 Logmein Lastpass 4.27.0 Logmein Lastpass 4.27.2 Logmein Lastpass 4.28.0 Logmein Lastpass 4.29.0 Logmein Lastpass 4.30.0 Logmein Lastpass 4.31.0 Logmein Lastpass 4.32.0	101

Common Weakness Enumeration (CWE)

CWE-1021 - Improper Restriction of Rendered UI Layers or Frames

References

https://bugs.chromium.org/p/project-zero/issues/detail?id=1930