Description

Unrestricted file size limit can lead to DoS in tooljet/tooljet <1.27 by allowing a logged in attacker to upload profile pictures over 2MB.

Remediation

References

https://github.com/tooljet/tooljet/commit/01cd3f0464747973ec329e9fb1ea12743d3235cc

https://huntr.dev/bounties/5596d072-66d2-4361-8cac-101c9c781c3d

Related Vulnerabilities

CVE-2020-28052 Vulnerability in maven package org.bouncycastle:bcprov-jdk15on

CVE-2023-45138 Vulnerability in maven package org.xwiki.contrib.changerequest:application-changerequest-ui

CVE-2018-11776 Vulnerability in maven package org.apache.struts:struts2-core

CVE-2023-37895 Vulnerability in maven package org.apache.jackrabbit:jackrabbit-webapp

CVE-2017-16038 Vulnerability in npm package f2e-server

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Tags

Patch Third Party Advisory Exploit Issue Tracking NVD-CWE-noinfo