Server-side Request Forgery (SSRF)

2017-11-1409:30:11

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.004 Low

EPSS

Percentile

72.9%

JSON

The Python Recurly client is vulnerable to server-side request forgery (SSRF) attacks A malicious user can pass a URI from a different domain to gain access to API keys or other sensitive information.

CPENameOperatorVersion
recurlyeq2.3.0
recurlyeq2.5.0
recurlyle2.6.1
recurlyle2.0.4
recurlyle2.2.21
recurlyle2.4.4
recurlyle2.1.15

Name	Operator	Version
recurly	eq	2.3.0
recurly	eq	2.5.0
recurly	le	2.6.1
recurly	le	2.0.4
recurly	le	2.2.21
recurly	le	2.4.4
recurly	le	2.1.15

References

dev.recurly.com/page/python-updates

github.com/recurly/recurly-client-python/commit/049c74699ce93cf126feff06d632ea63fba36742

hackerone.com/reports/288635

0.004 Low

EPSS

Percentile

72.9%

JSON

Related for VERACODE:5430