GitHub Advisoryadvisory · Packagist

GHSA-q348-f93x-9gx4 Lack of Input Validation in zendesk_api_client_php for Zendesk Subdomain

CRITICAL Published 2021-04-29 Modified 2021-04-28 Official page ↗
Aliases
CVE-2021-30492
Ecosystem
Packagist
Packages
zendesk/zendesk_api_client_php
Severity
Critical
Weaknesses
CWE-20, CWE-918
Reviewed
2021-04-28

Affected packages

• Packagist zendesk/zendesk_api_client_php: < 2.2.11 → fixed in 2.2.11

Description

Impact Lack of input validation of the Zendesk subdomain could expose users of the library to Server Side Request Forgery (SSRF). Resolution Validate the provided Zendesk subdomain to be a valid subdomain in: • getAuthUrl • getAccessToken

Related

Alias · not in database (1)

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-918 Server-Side Request Forgery weakness

References