cve/2022/CVE-2022-4111.md

### [CVE-2022-4111](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4111)
![](https://img.shields.io/static/v1?label=Product&message=tooljet%2Ftooljet&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=unspecified%3C%20v1.27.0%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-1284%20Improper%20Validation%20of%20Specified%20Quantity%20in%20Input&color=brighgreen)

### Description

Unrestricted file size limit can lead to DoS in tooljet/tooljet <1.27 by allowing a logged in attacker to upload profile pictures over 2MB.

### POC

#### Reference
- https://huntr.dev/bounties/5596d072-66d2-4361-8cac-101c9c781c3d

#### Github
- https://github.com/fkie-cad/nvd-json-data-feeds