Skip to content
Fencer Vulns
critical —

CVE-2021-30492 json

Lack of Input Validation in zendesk_api_client_php for Zendesk Subdomain

published 2021-04-29 5 y ago modified 2024-12-02 23 mo ago also GHSA-q348-f93x-9gx4

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no EPSS score yet
public exploits
0
none known

Summary

### Impact Lack of input validation of the Zendesk subdomain could expose users of the library to Server Side Request Forgery (SSRF).

### Resolution Validate the provided Zendesk subdomain to be a valid subdomain in: * getAuthUrl * getAccessToken

Patch / fix

  • packagist zendesk/zendesk_api_client_php 2.2.11

Affected packages

ecosystem package affected fixed in
packagist zendesk/zendesk_api_client_php
<2.2.11
2.2.11

Classification

Weakness
  • CWE-20 Improper Input Validation
  • CWE-918 Server-Side Request Forgery

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.