gsd-2022-4111
Vulnerability from gsd
Modified
2023-12-13 01:19
Details
Unrestricted file size limit can lead to DoS in tooljet/tooljet <1.27 by allowing a logged in attacker to upload profile pictures over 2MB.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2022-4111",
"description": "What happens if a bot net starts uploading 100MB files from 100 machines at the same time. This would mean that our network pipes are clogged handling 10GB of data while slowing down our real customers..... the answer the site will down and come not available",
"id": "GSD-2022-4111"
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2022-4111"
],
"details": "Unrestricted file size limit can lead to DoS in tooljet/tooljet \u003c1.27 by allowing a logged in attacker to upload profile pictures over 2MB.\n\n",
"id": "GSD-2022-4111",
"modified": "2023-12-13T01:19:15.246421Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "security@huntr.dev",
"ID": "CVE-2022-4111",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "tooljet/tooljet",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "unspecified",
"version_value": "v1.27.0"
}
]
}
}
]
},
"vendor_name": "tooljet"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Unrestricted file size limit can lead to DoS in tooljet/tooljet \u003c1.27 by allowing a logged in attacker to upload profile pictures over 2MB.\n\n"
}
]
},
"generator": {
"engine": "Vulnogram 0.1.0-dev"
},
"impact": {
"cvss": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"cweId": "CWE-1284",
"lang": "eng",
"value": "CWE-1284 Improper Validation of Specified Quantity in Input"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://huntr.dev/bounties/5596d072-66d2-4361-8cac-101c9c781c3d",
"refsource": "MISC",
"url": "https://huntr.dev/bounties/5596d072-66d2-4361-8cac-101c9c781c3d"
},
{
"name": "https://github.com/tooljet/tooljet/commit/01cd3f0464747973ec329e9fb1ea12743d3235cc",
"refsource": "MISC",
"url": "https://github.com/tooljet/tooljet/commit/01cd3f0464747973ec329e9fb1ea12743d3235cc"
}
]
},
"source": {
"advisory": "5596d072-66d2-4361-8cac-101c9c781c3d",
"discovery": "EXTERNAL"
}
},
"gitlab.com": {
"advisories": [
{
"affected_range": "\u003c1.27.0",
"affected_versions": "All versions before 1.27.0",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-400",
"CWE-937"
],
"date": "2022-12-02",
"description": "Unrestricted file size limit can lead to DoS in tooljet/tooljet \u003c1.27 by allowing a logged in attacker to upload profile pictures over 2MB.",
"fixed_versions": [
"1.27.0"
],
"identifier": "CVE-2022-4111",
"identifiers": [
"GHSA-hgp8-w8fj-r4cm",
"CVE-2022-4111"
],
"not_impacted": "All versions starting from 1.27.0",
"package_slug": "npm/tooljet",
"pubdate": "2022-11-22",
"solution": "Upgrade to version 1.27.0 or above.",
"title": "Uncontrolled Resource Consumption",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2022-4111",
"https://github.com/tooljet/tooljet/commit/01cd3f0464747973ec329e9fb1ea12743d3235cc",
"https://huntr.dev/bounties/5596d072-66d2-4361-8cac-101c9c781c3d",
"https://github.com/ToolJet/ToolJet/pull/4103",
"https://github.com/advisories/GHSA-hgp8-w8fj-r4cm"
],
"uuid": "b790c041-1e4a-469c-ae61-4f47293291fc"
}
]
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:tooljet:tooljet:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "1.27.0",
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "security@huntr.dev",
"ID": "CVE-2022-4111"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "Unrestricted file size limit can lead to DoS in tooljet/tooljet \u003c1.27 by allowing a logged in attacker to upload profile pictures over 2MB.\n\n"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-1284"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/tooljet/tooljet/commit/01cd3f0464747973ec329e9fb1ea12743d3235cc",
"refsource": "MISC",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/tooljet/tooljet/commit/01cd3f0464747973ec329e9fb1ea12743d3235cc"
},
{
"name": "https://huntr.dev/bounties/5596d072-66d2-4361-8cac-101c9c781c3d",
"refsource": "CONFIRM",
"tags": [
"Exploit",
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://huntr.dev/bounties/5596d072-66d2-4361-8cac-101c9c781c3d"
}
]
}
},
"impact": {
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6
}
},
"lastModifiedDate": "2023-07-11T08:15Z",
"publishedDate": "2022-11-22T03:15Z"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…