CVE-2017-0907

State: Published
Severity: Not scored
Published: Nov 13, 2017
Updated: Sep 16, 2024
Reserved: Nov 30, 2016

Description

The Recurly Client .NET Library before 1.0.1, 1.1.10, 1.2.8, 1.3.2, 1.4.14, 1.5.3, 1.6.2, 1.7.1, 1.8.1 is vulnerable to a Server-Side Request Forgery vulnerability due to incorrect use of "Uri.EscapeUriString" that could result in compromise of API keys or other critical resources.

Scores

The record has no CVSS score.

Weaknesses

CWE-918 Server-Side Request Forgery (SSRF) (CWE-918)

Affected Products

Product	Versions
recurly-api-client .NET libraryRecurly	Versions before 1.0.1, 1.1.10, 1.2.8, 1.3.2, 1.4.14, 1.5.3, 1.6.2, 1.7.1, 1.8.1Affected

References

https://hackerone.com/reports/288635
https://github.com/recurly/recurly-client-net/commit/9eef460c0084afd5c24d66220c8b7a381cf9a1f1
https://dev.recurly.com/page/net-updates

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.