Skip to content

Lack of Input Validation in zendesk_api_client_php for Zendesk Subdomain

Critical
thekindofme published GHSA-q348-f93x-9gx4 Apr 28, 2021

Package

zendesk_api_client_php

Affected versions

<v2.2.11

Patched versions

v2.2.11

Description

Impact

Lack of input validation of the Zendesk subdomain could expose users of the library to Server Side Request Forgery (SSRF).

Resolution

Validate the provided Zendesk subdomain to be a valid subdomain in:

  • getAuthUrl
  • getAccessToken

References

Severity

Critical

CVE ID

CVE-2021-30492

Weaknesses