GHSA-q348-f93x-9gx4
Suggest an improvement- Source
- https://github.com/advisories/GHSA-q348-f93x-9gx4
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/04/GHSA-q348-f93x-9gx4/GHSA-q348-f93x-9gx4.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-q348-f93x-9gx4
- Aliases
-
- CVE-2021-30492
- Published
- 2021-04-29T21:53:06Z
- Modified
- 2024-12-02T05:55:17.026669Z
- Summary
- Lack of Input Validation in zendesk_api_client_php for Zendesk Subdomain
- Details
-
Impact
Lack of input validation of the Zendesk subdomain could expose users of the library to Server Side Request Forgery (SSRF).
Resolution
Validate the provided Zendesk subdomain to be a valid subdomain in: * getAuthUrl * getAccessToken
- Database specific
{ "nvd_published_at": null, "cwe_ids": [ "CWE-20", "CWE-918" ], "severity": "CRITICAL", "github_reviewed": true, "github_reviewed_at": "2021-04-28T22:29:16Z" }- References
Affected packages
Packagist / zendesk/zendesk_api_client_php
Package
- Name
- zendesk/zendesk_api_client_php
- Purl
- pkg:composer/zendesk/zendesk_api_client_php