CVE-2017-0907 Critical severity vulnerability that affects recurly-api-client
CriticalCVSS 9.8
EPSS 2.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Recurly Client .NET Library before 1.0.1, 1.1.10, 1.2.8, 1.3.2, 1.4.14, 1.5.3, 1.6.2, 1.7.1, 1.8.1 is vulnerable to a Server-Side Request Forgery vulnerability due to incorrect use of "Uri.EscapeUriString" that could result in compromise of API keys or other critical resources.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nuget recurly-api-client(NuGet) | < 1.0.1 | 1.0.1 |
| nuget recurly-api-client(NuGet) | >= 1.1.0, < 1.1.10 | 1.1.10 |
| nuget recurly-api-client(NuGet) | >= 1.2.0, < 1.2.8 | 1.2.8 |
| nuget recurly-api-client(NuGet) | >= 1.3.0, < 1.3.2 | 1.3.2 |
| nuget recurly-api-client(NuGet) | >= 1.4.0, < 1.4.14 | 1.4.14 |
| nuget recurly-api-client(NuGet) | >= 1.5.0, < 1.5.3 | 1.5.3 |
| nuget recurly-api-client(NuGet) | >= 1.6.0, < 1.6.2 | 1.6.2 |
| nuget recurly-api-client(NuGet) | = 1.7.0 | No fix listed |
| nuget recurly-api-client(NuGet) | = 1.8.0 | No fix listed |
| nuget recurly-api-client(NuGet) | = 1.0.0 | No fix listed |
| nuget recurly-api-client(NuGet) | = 1.1.0 | No fix listed |
| nuget recurly-api-client(NuGet) | = 1.1.1 | No fix listed |
| nuget recurly-api-client(NuGet) | = 1.1.2 | No fix listed |
| nuget recurly-api-client(NuGet) | = 1.1.3 | No fix listed |
| nuget recurly-api-client(NuGet) | = 1.1.4 | No fix listed |
| nuget recurly-api-client(NuGet) | = 1.1.5 | No fix listed |
| nuget recurly-api-client(NuGet) | = 1.1.6 | No fix listed |
| nuget recurly-api-client(NuGet) | = 1.1.7 | No fix listed |
| nuget recurly-api-client(NuGet) | = 1.1.8 | No fix listed |
| nuget recurly-api-client(NuGet) | = 1.1.9 | No fix listed |
| nuget recurly-api-client(NuGet) | = 1.2.0 | No fix listed |
| nuget recurly-api-client(NuGet) | = 1.2.1 | No fix listed |
| nuget recurly-api-client(NuGet) | = 1.2.2 | No fix listed |
| nuget recurly-api-client(NuGet) | = 1.2.3 | No fix listed |
| nuget recurly-api-client(NuGet) | = 1.2.4 | No fix listed |
Show 71 more
| Product | Affected versions | Fixed in |
|---|---|---|
| nuget recurly-api-client(NuGet) | = 1.2.5 | No fix listed |
| nuget recurly-api-client(NuGet) | = 1.2.6 | No fix listed |
| nuget recurly-api-client(NuGet) | = 1.2.7 | No fix listed |
| nuget recurly-api-client(NuGet) | = 1.3.0 | No fix listed |
| nuget recurly-api-client(NuGet) | = 1.3.1 | No fix listed |
| nuget recurly-api-client(NuGet) | = 1.4.0 | No fix listed |
| nuget recurly-api-client(NuGet) | = 1.4.1 | No fix listed |
| nuget recurly-api-client(NuGet) | = 1.4.10 | No fix listed |
| nuget recurly-api-client(NuGet) | = 1.4.11 | No fix listed |
| nuget recurly-api-client(NuGet) | = 1.4.12 | No fix listed |
| nuget recurly-api-client(NuGet) | = 1.4.13 | No fix listed |
| nuget recurly-api-client(NuGet) | = 1.4.2 | No fix listed |
| nuget recurly-api-client(NuGet) | = 1.4.3 | No fix listed |
| nuget recurly-api-client(NuGet) | = 1.4.4 | No fix listed |
| nuget recurly-api-client(NuGet) | = 1.4.5 | No fix listed |
| nuget recurly-api-client(NuGet) | = 1.4.6 | No fix listed |
| nuget recurly-api-client(NuGet) | = 1.4.7 | No fix listed |
| nuget recurly-api-client(NuGet) | = 1.4.8 | No fix listed |
| nuget recurly-api-client(NuGet) | = 1.4.9 | No fix listed |
| nuget recurly-api-client(NuGet) | = 1.5.0 | No fix listed |
| nuget recurly-api-client(NuGet) | = 1.5.1 | No fix listed |
| nuget recurly-api-client(NuGet) | = 1.5.2 | No fix listed |
| nuget recurly-api-client(NuGet) | = 1.6.0 | No fix listed |
| nuget recurly-api-client(NuGet) | = 1.6.1 | No fix listed |
| nuget recurly-api-client(NuGet) | >= 1.7.0, < 1.7.1 | 1.7.1 |
| nuget recurly-api-client(NuGet) | >= 1.8.0, < 1.8.1 | 1.8.1 |
| recurly client .net | = 1.0.0 | No fix listed |
| recurly client .net | = 1.0.0-beta1 | No fix listed |
| recurly client .net | = 1.0.0-beta2 | No fix listed |
| recurly client .net | = 1.0.0-beta3 | No fix listed |
| recurly client .net | = 1.0.0-rc1 | No fix listed |
| recurly client .net | = 1.0.0.1 | No fix listed |
| recurly client .net | = 1.0.0.2 | No fix listed |
| recurly client .net | = 1.0.0.3 | No fix listed |
| recurly client .net | = 1.0.0.4 | No fix listed |
| recurly client .net | = 1.1.0 | No fix listed |
| recurly client .net | = 1.1.1 | No fix listed |
| recurly client .net | = 1.1.4 | No fix listed |
| recurly client .net | = 1.1.5 | No fix listed |
| recurly client .net | = 1.1.6 | No fix listed |
| recurly client .net | = 1.1.7 | No fix listed |
| recurly client .net | = 1.1.8 | No fix listed |
| recurly client .net | = 1.1.9 | No fix listed |
| recurly client .net | = 1.2.0 | No fix listed |
| recurly client .net | = 1.2.1 | No fix listed |
| recurly client .net | = 1.2.2 | No fix listed |
| recurly client .net | = 1.2.5 | No fix listed |
| recurly client .net | = 1.2.6 | No fix listed |
| recurly client .net | = 1.2.7 | No fix listed |
| recurly client .net | = 1.3.0 | No fix listed |
| recurly client .net | = 1.3.1 | No fix listed |
| recurly client .net | = 1.4.0 | No fix listed |
| recurly client .net | = 1.4.1 | No fix listed |
| recurly client .net | = 1.4.2 | No fix listed |
| recurly client .net | = 1.4.3 | No fix listed |
| recurly client .net | = 1.4.4 | No fix listed |
| recurly client .net | = 1.4.5 | No fix listed |
| recurly client .net | = 1.4.6 | No fix listed |
| recurly client .net | = 1.4.7 | No fix listed |
| recurly client .net | = 1.4.8 | No fix listed |
| recurly client .net | = 1.4.9 | No fix listed |
| recurly client .net | = 1.4.10 | No fix listed |
| recurly client .net | = 1.4.11 | No fix listed |
| recurly client .net | = 1.4.12 | No fix listed |
| recurly client .net | = 1.4.13 | No fix listed |
| recurly client .net | = 1.5.0 | No fix listed |
| recurly client .net | = 1.6.0 | No fix listed |
| recurly client .net | = 1.6.1 | No fix listed |
| recurly client .net | = 1.7.0 | No fix listed |
| recurly client .net | = 1.8.0 | No fix listed |
| recurly-api-client .NET library | = Versions before 1.0.1, 1.1.10, 1.2.8, 1.3.2, 1.4.14, 1.5.3, 1.6.2, 1.7.1, 1.8.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch third-party-advisory
- hackerone.com permissions-required
- dev.recurly.com vendor-advisory
- github.com vendor-advisory