VULNERABILITY INTELLIGENCE

CVE-2014-8609

CVSS score7.2 HIGH
EPSS probability0.65%
CISA KEVNot currently listed
Published2014-12-15
Last modified2026-06-17
CVSS vectorAV:L/AC:L/Au:N/C:C/I:C/A:C

Description

The addAccount method in src/com/android/settings/accounts/AddAccountSettings.java in the Settings application in Android before 5.0.0 does not properly create a PendingIntent, which allows attackers to use the SYSTEM uid for broadcasting an intent with arbitrary component, action, or category information via a third-party authenticator in a crafted application, aka Bug 17356824.

Primary references