CVE-2017-0906 - The Recurly Client Python Library before 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1, 2.6.2 is vulnerable to a Server-Side Request Forgery vulnerability in the "Resource.get" method that could result in compromise of API keys or other critical resources

Back Back to CVE browser

CRITICAL

The Recurly Client Python Library before 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1, 2.6.2 is vulnerable to a Server-Side Request Forgery vulnerability in the "Resource.get" method that could result in compromise of API keys or other critical resources

Published Nov 13, 2017

9.3

CRITICAL

CVSS 4.0

EPSS 2.62%

Description

The Recurly Client Python Library before 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1, 2.6.2 is vulnerable to a Server-Side Request Forgery vulnerability in the "Resource.get" method that could result in compromise of API keys or other critical resources.

Affected products

Vendor Recurly Product Recurly Python Module Default
n/a
- Version
  Versions before 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1, 2.6.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Recurly

Recurly Python Module

n/a

Version	Status	Constraints
Versions before 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1, 2.6.2	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-918

SSRF

References (6)

https://dev.recurly.com/page/python-updates
x_refsource_CONFIRMVendor Advisory
https://github.com/advisories/GHSA-38rv-5jqc-m2cv
Advisory
https://github.com/pypa/advisory-database/tree/main/vulns/recurly/PYSEC-2017-68.yaml
https://github.com/recurly/recurly-client-python/commit/049c74699ce93cf126feff06d632ea63fba36742
x_refsource_CONFIRMPatchThird Party Advisory
https://hackerone.com/reports/288635
x_refsource_MISCPermissions Required
https://nvd.nist.gov/vuln/detail/CVE-2017-0906

Link	Providers	Tags
https://dev.recurly.com/page/python-updates		x_refsource_CONFIRMVendor Advisory
https://github.com/advisories/GHSA-38rv-5jqc-m2cv		Advisory
https://github.com/pypa/advisory-database/tree/main/vulns/recurly/PYSEC-2017-68.yaml
https://github.com/recurly/recurly-client-python/commit/049c74699ce93cf126feff06d632ea63fba36742		x_refsource_CONFIRMPatchThird Party Advisory
https://hackerone.com/reports/288635		x_refsource_MISCPermissions Required
https://nvd.nist.gov/vuln/detail/CVE-2017-0906