CVE-2022-0343

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A local attacker, as a different local user, may be able to send a HTTP request to 127.0.0.1:10000 after the user (typically a developer) manually invoked the ./tools/run-dev-server script. It is recommended to upgrade to any version beyond 24.2

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-275

Affected software

Vendor	Product	Versions
Google LLC	Perfetto Dev Scripts	>= unspecified, <= 24.2

References

https://android-review.googlesource.com/c/platform/external/perfetto/+/1999296/Patch, Third Party Advisory
https://android-review.googlesource.com/c/platform/external/perfetto/+/1999296/Patch, Third Party Advisory

Timeline

Published: Mar 29, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-03444.3An issue has been discovered in GitLab affecting all versions starting from 10.0 before 14.5.4, all versions starting from 10.1 before 14.6.CVE-2022-03454.3The Customize WordPress Emails and Alerts WordPress plugin before 1.8.7 does not have authorisation and CSRF check in its bnfw_search_users CVE-2022-03466.1The XML Sitemap Generator for Google WordPress plugin before 2.0.4 does not validate a parameter which can be set to an arbitrary value, thu CVE-2022-03476.1The LoginPress | Custom Login Page Customizer WordPress plugin before 1.5.12 does not escape the redirect-page parameter before outputting i CVE-2022-03485.4Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.CVE-2022-03499.8The NotificationX WordPress plugin before 2.3.9 does not sanitise and escape the nx_id parameter before using it in a SQL statement, leading CVE-2022-03505.4Cross-site Scripting (XSS) - Stored in GitHub repository vanessa219/vditor prior to 3.8.13.CVE-2022-03517.8Access of Memory Location Before Start of Buffer in GitHub repository vim/vim prior to 8.2.CVE-2022-03526.1Cross-site Scripting (XSS) - Reflected in Pypi calibreweb prior to 0.6.16.CVE-2022-03534.4A denial of service vulnerability was reported in the Lenovo HardwareScanPlugin versions prior to 1.3.1.2 and Lenovo Diagnostics versi CVE-2022-03547.8A vulnerability was reported in Lenovo System Update that could allow a local user with interactive system access the ability to execute cod CVE-2022-03557.5Improper Removal of Sensitive Information Before Storage or Transfer in NPM simple-get prior to 4.0.1.