CVE-2019-16371: 
LastPass vulnerability analysis and mitigation

LogMeIn LastPass before version 4.33.0 contains a security vulnerability (CVE-2019-16371) that allows attackers to construct a crafted website capable of capturing credentials for a victim's account on a previously visited website. The vulnerability exists because the do_popupregister function can be bypassed via clickjacking. This vulnerability was disclosed in September 2019 (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 8.2 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N. The vulnerability is related to improper restriction of rendered UI layers or frames (CWE-1021). The attack requires user interaction, as the victim must visit a maliciously crafted website, but no privileges are required for exploitation (NVD).

If successfully exploited, this vulnerability allows attackers to capture credentials from previously visited websites through clickjacking techniques. This could lead to unauthorized access to user accounts and potential compromise of sensitive information stored in those accounts (NVD).

The vulnerability requires user interaction but is relatively straightforward to exploit through a crafted website. The attack vector is network-based (AV:N) with low attack complexity (AC:L) and requires no privileges (PR:N). Proof of concept details are available in the Project Zero issue tracker (Project Zero).

The vulnerability has been fixed in LastPass version 4.33.0. Users should update to this version or later to protect against this security issue. No alternative workarounds have been publicly documented (NVD).