GHSA-38rv-5jqc-m2cvCriticalCVSS 9.8

Recurly vulnerable to SSRF

Published
January 4, 2019
Last Modified
October 26, 2024

🔗 CVE IDs covered (1)

CVE-2017-0906 →

📋 Description

The Recurly Client Python Library before 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1, 2.6.2 is vulnerable to a Server-Side Request Forgery vulnerability in the Resource.get method that could result in compromise of API keys or other critical resources.

🎯 Affected products7

  • pip/recurly:>= 2.6.0, < 2.6.2
  • pip/recurly:= 2.5.0
  • pip/recurly:>= 2.4.0, < 2.4.5
  • pip/recurly:= 2.3.0
  • pip/recurly:>= 2.2.0, < 2.2.22
  • pip/recurly:>= 2.1.0, < 2.1.16
  • pip/recurly:< 2.0.5

🔗 References (6)