CVE-2017-0905

CRITICAL

Recurly Client Ruby Library <2.0.13-2.11.3 - SSRF

Title source: llm
STIX 2.1

Description

The Recurly Client Ruby Library before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3 is vulnerable to a Server-Side Request Forgery vulnerability in the "Resource#find" method that could result in compromise of API keys or other critical resources.

References (3)

Core 3
Core References
Vendor Advisory x_refsource_confirm
https://dev.recurly.com/page/ruby-updates
Permissions Required x_refsource_misc
https://hackerone.com/reports/288635

Scores

CVSS v3 9.8
EPSS 0.0052
EPSS Percentile 66.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-918
Status published
Products (48)
Recurly/recurly ruby gem Versions before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.
recurly/recurly_client_ruby 2.0.0
recurly/recurly_client_ruby 2.0.1
recurly/recurly_client_ruby 2.0.2
recurly/recurly_client_ruby 2.0.3
recurly/recurly_client_ruby 2.0.4
recurly/recurly_client_ruby 2.0.5
recurly/recurly_client_ruby 2.0.6
recurly/recurly_client_ruby 2.0.7
recurly/recurly_client_ruby 2.0.8
... and 38 more
Published Nov 13, 2017
Tracked Since Feb 18, 2026