VULNERABILITY INTELLIGENCE
CVE-2009-1754
CVSS score4.3 MEDIUM
EPSS probability0.68%
CISA KEVNot currently listed
Published2009-05-26
Last modified2026-06-16
CVSS vectorAV:N/AC:M/Au:N/C:P/I:N/A:N
Description
The PackageManagerService class in services/java/com/android/server/PackageManagerService.java in Android 1.5 through 1.5 CRB42 does not properly check developer certificates during processing of sharedUserId requests at an application's installation time, which allows remote user-assisted attackers to access application data by creating a package that specifies a shared user ID with an arbitrary application.
Weakness classification
- CWE-287: Improper Authentication