{"id":"CVE-2017-0905","aliases":["EUVD-2017-0367","GHSA-x27v-x225-gq8g"],"status":"published","title":"Recurly gem Server-Side Request Forgery in Resource#find method","description":"The Recurly Client Ruby Library before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3 is vulnerable to a Server-Side Request Forgery vulnerability in the \"Resource#find\" method that could result in compromise of API keys or other critical resources.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02594,"percentile":0.85406,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-918"],"published":"2017-11-13T17:00:00Z","modified":"2026-10-20T10:47:34Z","fixes":[{"ecosystem":"RubyGems","package":"recurly","fixed_in":["2.11.3","2.10.4","2.9.2","2.8.2","2.7.8","2.6.3","2.5.4","2.4.11","2.3.10","2.2.5","2.1.11","2.0.13"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"recurly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.0"},{"fixed":"2.11.3"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"recurly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.0"},{"fixed":"2.10.4"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"recurly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.0"},{"fixed":"2.9.2"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"recurly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.0"},{"fixed":"2.8.2"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"recurly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"fixed":"2.7.8"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"recurly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"2.6.3"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"recurly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.4"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"recurly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.11"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"recurly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.10"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"recurly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.2.5"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"recurly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.1.11"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"recurly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.13"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"recurly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.10"}]}],"versions":["2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9"]},{"source":"osv","ecosystem":"RubyGems","package":"recurly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.2.5"}]}],"versions":["2.2.0","2.2.1","2.2.2","2.2.3","2.2.4"]},{"source":"osv","ecosystem":"RubyGems","package":"recurly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.1.11"}]}],"versions":["2.1.0","2.1.1","2.1.10","2.1.2","2.1.3","2.1.4","2.1.5","2.1.7","2.1.8","2.1.9"]},{"source":"osv","ecosystem":"RubyGems","package":"recurly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.13"}]}],"versions":["2.0.0","2.0.1","2.0.10","2.0.11","2.0.12","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.8","2.0.9"]},{"source":"osv","ecosystem":"RubyGems","package":"recurly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.0"},{"fixed":"2.9.2"}]}],"versions":["2.9.0","2.9.1"]},{"source":"osv","ecosystem":"RubyGems","package":"recurly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.0"},{"fixed":"2.8.2"}]}],"versions":["2.8.0","2.8.1"]},{"source":"osv","ecosystem":"RubyGems","package":"recurly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"fixed":"2.7.8"}]}],"versions":["2.7.0","2.7.1","2.7.2","2.7.3","2.7.4","2.7.5","2.7.6","2.7.7"]},{"source":"osv","ecosystem":"RubyGems","package":"recurly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"2.6.3"}]}],"versions":["2.6.0","2.6.1","2.6.2"]},{"source":"osv","ecosystem":"RubyGems","package":"recurly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.4"}]}],"versions":["2.5.0","2.5.1","2.5.2","2.5.3"]},{"source":"osv","ecosystem":"RubyGems","package":"recurly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.11"}]}],"versions":["2.4.0","2.4.1","2.4.10","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.4.7","2.4.8","2.4.9"]},{"source":"osv","ecosystem":"RubyGems","package":"recurly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.0"},{"fixed":"2.11.3"}]}],"versions":["2.11.0","2.11.1","2.11.2"]},{"source":"osv","ecosystem":"RubyGems","package":"recurly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.0"},{"fixed":"2.10.4"}]}],"versions":["2.10.0","2.10.1","2.10.2","2.10.3"]}],"products":[{"vendor":"recurly","product":"recurly ruby gem"},{"vendor":"recurly","product":"recurly_client_ruby"}],"references":[{"url":"https://dev.recurly.com/page/ruby-updates","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://hackerone.com/reports/288635","tags":["x_refsource_MISC","x_transferred","Permissions Required","report","web"]},{"url":"https://github.com/recurly/recurly-client-ruby/commit/1bb0284d6e668b8b3d31167790ed6db1f6ccc4be","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-0905","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/recurly/CVE-2017-0905.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-x27v-x225-gq8g"},{"url":"https://github.com/recurly/recurly-client-ruby","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2017-0905","description":"The Recurly Client Ruby Library before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3 is vulnerable to a Server-Side Request Forgery vulnerability in the \"Resource#find\" method that could result in compromise of API keys or other critical resources.","status":"published","published":"2017-11-13T17:00:00Z","modified":"2024-09-16T23:56:22.112Z","cwes":["CWE-918"],"updated_at":"2026-11-02T14:33:22.381225Z"}],"euvd":[{"id":"EUVD-2017-0367","description":"The Recurly Client Ruby Library before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3 is vulnerable to a Server-Side Request Forgery vulnerability in the \"Resource#find\" method that could result in compromise of API keys or other critical resources.","status":"published","published":"2017-11-13T17:00:00Z","modified":"2024-09-16T23:56:22Z","updated_at":"2026-11-03T00:29:03.911526Z"}],"ghsa":[{"id":"GHSA-x27v-x225-gq8g","title":"Recurly gem Server-Side Request Forgery in Resource#find method","description":"The Recurly Client Ruby Library before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3 is vulnerable to a Server-Side Request Forgery vulnerability in the `Resource#find` method that could result in compromise of API keys or other critical resources.","status":"published","published":"2017-12-06T16:43:00Z","modified":"2023-08-29T15:38:46Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:37:01.345964Z"}],"nvd":[{"id":"CVE-2017-0905","description":"The Recurly Client Ruby Library before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3 is vulnerable to a Server-Side Request Forgery vulnerability in the \"Resource#find\" method that could result in compromise of API keys or other critical resources.","status":"published","published":"2017-11-13T17:29:00.427Z","modified":"2026-06-17T00:58:30.197Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:04:08.635428Z"}],"osv":[{"id":"CVE-2017-0905","description":"The Recurly Client Ruby Library before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3 is vulnerable to a Server-Side Request Forgery vulnerability in the \"Resource#find\" method that could result in compromise of API keys or other critical resources.","status":"published","published":"2017-11-13T17:29:00.427Z","modified":"2026-10-20T10:47:34.088125067Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:03.472693Z"},{"id":"GHSA-x27v-x225-gq8g","title":"Recurly gem Server-Side Request Forgery in Resource#find method","description":"The Recurly Client Ruby Library before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3 is vulnerable to a Server-Side Request Forgery vulnerability in the `Resource#find` method that could result in compromise of API keys or other critical resources.","status":"published","published":"2017-12-06T16:43:00Z","modified":"2024-02-16T08:21:56.684023Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:46:59.131095Z"}]}}