Lucene search

[email protected]CVE-2017-0905

HistoryNov 13, 2017 - 5:29 p.m.

CVE-2017-0905

2017-11-1317:29:00

CWE-918

[email protected]

web.nvd.nist.gov

cve-2017-0905

recurly client ruby library

server-side request forgery

api keys

nvd

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.4 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

73.0%

JSON

The Recurly Client Ruby Library before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3 is vulnerable to a Server-Side Request Forgery vulnerability in the “Resource#find” method that could result in compromise of API keys or other critical resources.

Affected configurations

NVD

Node

recurlyrecurly_client_rubyMatch2.0.0

recurlyrecurly_client_rubyMatch2.0.1

recurlyrecurly_client_rubyMatch2.0.2

recurlyrecurly_client_rubyMatch2.0.3

recurlyrecurly_client_rubyMatch2.0.4

recurlyrecurly_client_rubyMatch2.0.5

recurlyrecurly_client_rubyMatch2.0.6

recurlyrecurly_client_rubyMatch2.0.7

recurlyrecurly_client_rubyMatch2.0.8

recurlyrecurly_client_rubyMatch2.0.9

recurlyrecurly_client_rubyMatch2.0.10

recurlyrecurly_client_rubyMatch2.0.11

recurlyrecurly_client_rubyMatch2.0.12

Node

recurlyrecurly_client_rubyMatch2.1.0

recurlyrecurly_client_rubyMatch2.1.0c

recurlyrecurly_client_rubyMatch2.1.1

recurlyrecurly_client_rubyMatch2.1.2

recurlyrecurly_client_rubyMatch2.1.3

recurlyrecurly_client_rubyMatch2.1.4

recurlyrecurly_client_rubyMatch2.1.5

recurlyrecurly_client_rubyMatch2.1.6

recurlyrecurly_client_rubyMatch2.1.7

recurlyrecurly_client_rubyMatch2.1.8

recurlyrecurly_client_rubyMatch2.1.9

recurlyrecurly_client_rubyMatch2.1.10

Node

recurlyrecurly_client_rubyMatch2.2.0

recurlyrecurly_client_rubyMatch2.2.1

recurlyrecurly_client_rubyMatch2.2.2

recurlyrecurly_client_rubyMatch2.2.3

recurlyrecurly_client_rubyMatch2.2.4

Node

recurlyrecurly_client_rubyMatch2.3.0

recurlyrecurly_client_rubyMatch2.3.0beta1

recurlyrecurly_client_rubyMatch2.3.1

recurlyrecurly_client_rubyMatch2.3.2

recurlyrecurly_client_rubyMatch2.3.3

recurlyrecurly_client_rubyMatch2.3.4

recurlyrecurly_client_rubyMatch2.3.5

recurlyrecurly_client_rubyMatch2.3.6

recurlyrecurly_client_rubyMatch2.3.7

recurlyrecurly_client_rubyMatch2.3.8

recurlyrecurly_client_rubyMatch2.3.9

Node

recurlyrecurly_client_rubyMatch2.4.0

recurlyrecurly_client_rubyMatch2.4.1

recurlyrecurly_client_rubyMatch2.4.2

recurlyrecurly_client_rubyMatch2.4.3

recurlyrecurly_client_rubyMatch2.4.4

recurlyrecurly_client_rubyMatch2.4.5

recurlyrecurly_client_rubyMatch2.4.6

recurlyrecurly_client_rubyMatch2.4.7

recurlyrecurly_client_rubyMatch2.4.8

recurlyrecurly_client_rubyMatch2.4.9

recurlyrecurly_client_rubyMatch2.4.10

Node

recurlyrecurly_client_rubyMatch2.5.0

recurlyrecurly_client_rubyMatch2.5.1

recurlyrecurly_client_rubyMatch2.5.2

recurlyrecurly_client_rubyMatch2.5.3

Node

recurlyrecurly_client_rubyMatch2.6.0

recurlyrecurly_client_rubyMatch2.6.1

recurlyrecurly_client_rubyMatch2.6.2

Node

recurlyrecurly_client_rubyMatch2.7.0

recurlyrecurly_client_rubyMatch2.7.1

recurlyrecurly_client_rubyMatch2.7.2

recurlyrecurly_client_rubyMatch2.7.3

recurlyrecurly_client_rubyMatch2.7.4

recurlyrecurly_client_rubyMatch2.7.5

recurlyrecurly_client_rubyMatch2.7.6

recurlyrecurly_client_rubyMatch2.7.7

Node

recurlyrecurly_client_rubyMatch2.8.0

recurlyrecurly_client_rubyMatch2.8.0rc1

recurlyrecurly_client_rubyMatch2.8.0rc3

recurlyrecurly_client_rubyMatch2.8.1

Node

recurlyrecurly_client_rubyMatch2.9.0

recurlyrecurly_client_rubyMatch2.9.1

Node

recurlyrecurly_client_rubyMatch2.10.0

recurlyrecurly_client_rubyMatch2.10.1

recurlyrecurly_client_rubyMatch2.10.2

recurlyrecurly_client_rubyMatch2.10.3

Node

recurlyrecurly_client_rubyMatch2.11.0

recurlyrecurly_client_rubyMatch2.11.1

recurlyrecurly_client_rubyMatch2.11.2

CPENameOperatorVersion
recurly:recurly_client_rubyrecurly recurly client rubyeq2.0.0
recurly:recurly_client_rubyrecurly recurly client rubyeq2.0.1
recurly:recurly_client_rubyrecurly recurly client rubyeq2.0.2
recurly:recurly_client_rubyrecurly recurly client rubyeq2.0.3
recurly:recurly_client_rubyrecurly recurly client rubyeq2.0.4
recurly:recurly_client_rubyrecurly recurly client rubyeq2.0.5
recurly:recurly_client_rubyrecurly recurly client rubyeq2.0.6
recurly:recurly_client_rubyrecurly recurly client rubyeq2.0.7
recurly:recurly_client_rubyrecurly recurly client rubyeq2.0.8
recurly:recurly_client_rubyrecurly recurly client rubyeq2.0.9

CPE	Name	Operator	Version
recurly:recurly_client_ruby	recurly recurly client ruby	eq	2.0.0
recurly:recurly_client_ruby	recurly recurly client ruby	eq	2.0.1
recurly:recurly_client_ruby	recurly recurly client ruby	eq	2.0.2
recurly:recurly_client_ruby	recurly recurly client ruby	eq	2.0.3
recurly:recurly_client_ruby	recurly recurly client ruby	eq	2.0.4
recurly:recurly_client_ruby	recurly recurly client ruby	eq	2.0.5
recurly:recurly_client_ruby	recurly recurly client ruby	eq	2.0.6
recurly:recurly_client_ruby	recurly recurly client ruby	eq	2.0.7
recurly:recurly_client_ruby	recurly recurly client ruby	eq	2.0.8
recurly:recurly_client_ruby	recurly recurly client ruby	eq	2.0.9

Rows per page:

1-10 of 131

CNA Affected

[
  {
    "product": "recurly ruby gem",
    "vendor": "Recurly",
    "versions": [
      {
        "status": "affected",
        "version": "Versions before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3"
      }
    ]
  }
]

References

dev.recurly.com/page/ruby-updates

github.com/recurly/recurly-client-ruby/commit/1bb0284d6e668b8b3d31167790ed6db1f6ccc4be

hackerone.com/reports/288635

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.4 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

73.0%

JSON

Related for CVE-2017-0905

osv2 veracode1 nvd1 github1 prion1 cvelist1