Back
CVE-2017-0905
CRITICAL
The Recurly Client Ruby Library before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3 is vulnerable to a Server-Side Request Forgery vulnerability in the "Resource#find" method that could result in compromise of API keys or other critical resources.
Published: Nov 13, 2017
Modified: Jun 17, 2026
CWE-918
CWE-918
CVSS Metrics
CVSSv3
Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products (80)
| Vendor | Product | Version |
|---|---|---|
| recurly | recurly_client_ruby | 2.0.0 |
| recurly | recurly_client_ruby | 2.0.1 |
| recurly | recurly_client_ruby | 2.0.2 |
| recurly | recurly_client_ruby | 2.0.3 |
| recurly | recurly_client_ruby | 2.0.4 |
| recurly | recurly_client_ruby | 2.0.5 |
| recurly | recurly_client_ruby | 2.0.6 |
| recurly | recurly_client_ruby | 2.0.7 |
| recurly | recurly_client_ruby | 2.0.8 |
| recurly | recurly_client_ruby | 2.0.9 |
| recurly | recurly_client_ruby | 2.0.10 |
| recurly | recurly_client_ruby | 2.0.11 |
| recurly | recurly_client_ruby | 2.0.12 |
| recurly | recurly_client_ruby | 2.1.0 |
| recurly | recurly_client_ruby | 2.1.0 |
| recurly | recurly_client_ruby | 2.1.1 |
| recurly | recurly_client_ruby | 2.1.2 |
| recurly | recurly_client_ruby | 2.1.3 |
| recurly | recurly_client_ruby | 2.1.4 |
| recurly | recurly_client_ruby | 2.1.5 |
…and 60 more
GitHub Security Advisory GHSA-x27v-x225-gq8g
Recurly gem Server-Side Request Forgery in Resource#find method
rubygems
recurly
>= 2.11.0, < 2.11.3
Fixed: 2.11.3
rubygems
recurly
>= 2.10.0, < 2.10.4
Fixed: 2.10.4
rubygems
recurly
>= 2.9.0, < 2.9.2
Fixed: 2.9.2
rubygems
recurly
>= 2.8.0, < 2.8.2
Fixed: 2.8.2
rubygems
recurly
>= 2.7.0, < 2.7.8
Fixed: 2.7.8
rubygems
recurly
>= 2.6.0, < 2.6.3
Fixed: 2.6.3
rubygems
recurly
>= 2.5.0, < 2.5.4
Fixed: 2.5.4
rubygems
recurly
>= 2.4.0, < 2.4.11
Fixed: 2.4.11
rubygems
recurly
>= 2.3.0, < 2.3.10
Fixed: 2.3.10
rubygems
recurly
>= 2.2.0, < 2.2.5
Fixed: 2.2.5
rubygems
recurly
>= 2.1.0, < 2.1.11
Fixed: 2.1.11
rubygems
recurly
>= 2.0.0, < 2.0.13
Fixed: 2.0.13
References (6)
- https://dev.recurly.com/page/ruby-updates Vendor Advisory
- https://github.com/recurly/recurly-client-ruby/commit/1bb0284d6e668b8b3d31167790ed6db1f6ccc4be Patch, Third Party Advisory
- https://hackerone.com/reports/288635 Permissions Required
- https://dev.recurly.com/page/ruby-updates Vendor Advisory
- https://github.com/recurly/recurly-client-ruby/commit/1bb0284d6e668b8b3d31167790ed6db1f6ccc4be Patch, Third Party Advisory
- https://hackerone.com/reports/288635 Permissions Required
Risk Scores
CVSS Score
9.8 / 10
EPSS Score
2.59%
Top 16% most likely to be exploited
Threat Score
40 / 100
Data Sources
NVD
EPSS
GitHub