GHSA-q348-f93x-9gx4Critical

Lack of Input Validation in zendesk_api_client_php for Zendesk Subdomain

Published
April 29, 2021
Last Modified
January 9, 2023

🔗 CVE IDs covered (1)

CVE-2021-30492 →

📋 Description

Impact

Lack of input validation of the Zendesk subdomain could expose users of the library to Server Side Request Forgery (SSRF).

Resolution

Validate the provided Zendesk subdomain to be a valid subdomain in:

  • getAuthUrl
  • getAccessToken

🎯 Affected products1

  • composer/zendesk/zendesk_api_client_php:< 2.2.11

🔗 References (4)