CVE-2014-8507: n/a vulnerability

CVE-2014-8507: Multiple SQL injection vulnerabilities in the queryLastApp method in packages/WAPPushManager/src/com/androi...

Multiple SQL injection vulnerabilities in the queryLastApp method in packages/WAPPushManager/src/com/android/smspush/WapPushManager.java in the WAPPushManager module in Android before 5.0.0 allow remote attackers to execute arbitrary SQL commands, and consequently launch an activity or service, via the (1) wapAppId or (2) contentType field of a PDU for a malformed WAPPush message, aka Bug 17969135.

UnknownCVSS not scoredNot KEV-listedUpdatedAug 6, 2024, 13:18 UTC (UTC+00:00)

Security readout for executives and security teams

This older Android flaw affects WAPPushManager before Android 5.0.0. A malformed WAP Push message could trigger SQL injection and may cause an activity or service to launch. The source bundle does not provide CVSS or confirmed exploitation evidence, but affected legacy devices should be treated as operationally risky. Exposure is most likely on Android devices running versions before 5.0.0, especially unmanaged, unsupported, or carrier-frozen legacy builds. The provided affected-product metadata is incomplete, so exposure should be validated through device OS and firmware inventories. Prioritize remediation where legacy Android devices still access business email, internal apps, or regulated data. This is a legacy-platform risk with incomplete severity scoring, so the business decision is mainly whether unsupported Android devices remain trusted. Mitigation focus: Inventory Android devices and identify builds earlier than 5.0.0.; Update affected devices to Android 5.0.0 or vendor firmware containing the fix.; Retire or isolate devices that cannot receive patched firmware..

Prepared: Jun 14, 2026, 05:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Database behavior lookup

The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup

cve · low confidence lookup

CVE-2014-8507 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup

Vulnerability profileCVE Program record

Severity: Unknown
CVSS: Not scored
Known Exploited: No
Published: Dec 15, 2014, 17:27 UTC (UTC+00:00)

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors

0Timeline events

0ADP providers

2Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

CVE List V5 sourceCVE List V5
https://android.googlesource.com/platform/frameworks/base/+/48ed835468c6235905459e6ef7df032baf3e4df6CVE reference · x_refsource_CONFIRM

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus

n/an/an/aListed

Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.