vendor:
Zendesk
by:
Luis Santana
8,8
CVSS
HIGH
Multiple
79, 352
CWE
Product Name: Zendesk
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: Yes
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2020
Zendesk Multiple Vulnerabilities
Luis Santana of the HackTalk Security team has found multiple vulnerabilities in Zendesk. These include XSS due to lack of input sanitation in the email address field of the anonymous_requests page, and CSRF due to lack of input sanitation in many forms, the most notable example being the new user creation form which allows an attacker to create a new administrative user.
Mitigation:
Input sanitation should be implemented for all forms and fields to prevent XSS and CSRF attacks.
