Critical CVE-2021-30492 GHSA-q348-f93x-9gx4

Lack of Input Validation in zendesk_api_client_php for Zendesk Subdomain

Published Apr 29, 2021 · Updated Dec 2, 2024 · Assigned by GHSA

Description

### Impact
Lack of input validation of the Zendesk subdomain could expose users of the library to Server Side Request Forgery (SSRF).

### Resolution
Validate the provided Zendesk subdomain to be a valid subdomain in:
* getAuthUrl
* getAccessToken

Ecosystem	Package	Affected	Fixed	Record
Packagist	zendesk/zendesk_api_client_php	< 2.2.11	2.2.11	GHSA-q348-f93x-9gx4