CVE-2017-0907

CRITICAL

Recurly Client .NET Library <1.0.1-1.8.1 - SSRF

Title source: llm
STIX 2.1

Description

The Recurly Client .NET Library before 1.0.1, 1.1.10, 1.2.8, 1.3.2, 1.4.14, 1.5.3, 1.6.2, 1.7.1, 1.8.1 is vulnerable to a Server-Side Request Forgery vulnerability due to incorrect use of "Uri.EscapeUriString" that could result in compromise of API keys or other critical resources.

References (3)

Core 3
Core References
Permissions Required x_refsource_misc
https://hackerone.com/reports/288635
Vendor Advisory x_refsource_confirm
https://dev.recurly.com/page/net-updates

Scores

CVSS v3 9.8
EPSS 0.0052
EPSS Percentile 66.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-918
Status published
Products (42)
nuget/recurly-api-client 0 - 1.0.1NuGet
Recurly/recurly-api-client .NET library Versions before 1.0.1, 1.1.10, 1.2.8, 1.3.2, 1.4.14, 1.5.3, 1.6.2, 1.7.1, 1.8.1
recurly/recurly_client_.net 1.0.0 (5 CPE variants)
recurly/recurly_client_.net 1.0.0.1
recurly/recurly_client_.net 1.0.0.2
recurly/recurly_client_.net 1.0.0.3
recurly/recurly_client_.net 1.0.0.4
recurly/recurly_client_.net 1.1.0
recurly/recurly_client_.net 1.1.1
recurly/recurly_client_.net 1.1.4
... and 32 more
Published Nov 13, 2017
Tracked Since Feb 18, 2026