Back
CVE-2017-0907
CRITICAL
The Recurly Client .NET Library before 1.0.1, 1.1.10, 1.2.8, 1.3.2, 1.4.14, 1.5.3, 1.6.2, 1.7.1, 1.8.1 is vulnerable to a Server-Side Request Forgery vulnerability due to incorrect use of "Uri.EscapeUriString" that could result in compromise of API keys or other critical resources.
Published: Nov 13, 2017
Modified: Jun 17, 2026
CWE-918
CWE-918
CVSS Metrics
CVSSv3
Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products (44)
| Vendor | Product | Version |
|---|---|---|
| recurly | recurly_client_.net | 1.0.0 |
| recurly | recurly_client_.net | 1.0.0 |
| recurly | recurly_client_.net | 1.0.0 |
| recurly | recurly_client_.net | 1.0.0 |
| recurly | recurly_client_.net | 1.0.0 |
| recurly | recurly_client_.net | 1.0.0.1 |
| recurly | recurly_client_.net | 1.0.0.2 |
| recurly | recurly_client_.net | 1.0.0.3 |
| recurly | recurly_client_.net | 1.0.0.4 |
| recurly | recurly_client_.net | 1.1.0 |
| recurly | recurly_client_.net | 1.1.1 |
| recurly | recurly_client_.net | 1.1.4 |
| recurly | recurly_client_.net | 1.1.5 |
| recurly | recurly_client_.net | 1.1.6 |
| recurly | recurly_client_.net | 1.1.7 |
| recurly | recurly_client_.net | 1.1.8 |
| recurly | recurly_client_.net | 1.1.9 |
| recurly | recurly_client_.net | 1.2.0 |
| recurly | recurly_client_.net | 1.2.1 |
| recurly | recurly_client_.net | 1.2.2 |
…and 24 more
GitHub Security Advisory GHSA-xpwp-rq3x-x6v7
Critical severity vulnerability that affects recurly-api-client
nuget
recurly-api-client
< 1.0.1
Fixed: 1.0.1
nuget
recurly-api-client
>= 1.1.0, < 1.1.10
Fixed: 1.1.10
nuget
recurly-api-client
>= 1.2.0, < 1.2.8
Fixed: 1.2.8
nuget
recurly-api-client
>= 1.3.0, < 1.3.2
Fixed: 1.3.2
nuget
recurly-api-client
>= 1.4.0, < 1.4.14
Fixed: 1.4.14
nuget
recurly-api-client
>= 1.5.0, < 1.5.3
Fixed: 1.5.3
nuget
recurly-api-client
>= 1.6.0, < 1.6.2
Fixed: 1.6.2
nuget
recurly-api-client
= 1.7.0
Fixed: 1.7.1
nuget
recurly-api-client
= 1.8.0
Fixed: 1.8.1
References (6)
- https://dev.recurly.com/page/net-updates Vendor Advisory
- https://github.com/recurly/recurly-client-net/commit/9eef460c0084afd5c24d66220c8b7a381cf9a1f1 Patch, Third Party Advisory
- https://hackerone.com/reports/288635 Permissions Required
- https://dev.recurly.com/page/net-updates Vendor Advisory
- https://github.com/recurly/recurly-client-net/commit/9eef460c0084afd5c24d66220c8b7a381cf9a1f1 Patch, Third Party Advisory
- https://hackerone.com/reports/288635 Permissions Required
Risk Scores
CVSS Score
9.8 / 10
EPSS Score
2.59%
Top 16% most likely to be exploited
Threat Score
40 / 100
Data Sources
NVD
EPSS
GitHub