Vulnerabilites related to recurly - recurly_client_python
Vulnerability from fkie_nvd
Published
2017-11-13 17:29
Modified
2025-04-20 01:37
Severity ?
9.8 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
The Recurly Client Python Library before 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1, 2.6.2 is vulnerable to a Server-Side Request Forgery vulnerability in the "Resource.get" method that could result in compromise of API keys or other critical resources.
References
support@hackerone.comhttps://dev.recurly.com/page/python-updatesVendor Advisory
support@hackerone.comhttps://github.com/recurly/recurly-client-python/commit/049c74699ce93cf126feff06d632ea63fba36742Patch, Third Party Advisory
support@hackerone.comhttps://hackerone.com/reports/288635Permissions Required
af854a3a-2127-422b-91ae-364da2661108https://dev.recurly.com/page/python-updatesVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/recurly/recurly-client-python/commit/049c74699ce93cf126feff06d632ea63fba36742Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://hackerone.com/reports/288635Permissions Required
Impacted products
Vendor Product Version
recurly recurly_client_python *
recurly recurly_client_python *
recurly recurly_client_python *
recurly recurly_client_python 2.3.0
recurly recurly_client_python *
recurly recurly_client_python 2.5.0
recurly recurly_client_python 2.6.0
recurly recurly_client_python 2.6.1


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:recurly:recurly_client_python:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "557D1B51-6392-4527-B1E3-2090E32CA9EF",
              "versionEndIncluding": "2.0.4",
              "versionStartIncluding": "2.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:recurly:recurly_client_python:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "40615C43-B326-44B4-A5AE-E2F70A44B8C7",
              "versionEndIncluding": "2.1.15",
              "versionStartIncluding": "2.1.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:recurly:recurly_client_python:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E6EB0197-8002-48CC-AC2F-86C81F75BB96",
              "versionEndIncluding": "2.2.21",
              "versionStartIncluding": "2.2.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:recurly:recurly_client_python:2.3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "703E03AB-A209-427E-AF2A-733AE854C038",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:recurly:recurly_client_python:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "29D290C7-CC59-4AA8-9CFD-936ED5E388B1",
              "versionEndIncluding": "2.4.4",
              "versionStartIncluding": "2.4.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:recurly:recurly_client_python:2.5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "12D506D9-3FE7-4775-BA47-EF65D67ACF25",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:recurly:recurly_client_python:2.6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "36D3D568-796D-4AAC-B44B-E01DBF470E24",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:recurly:recurly_client_python:2.6.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "15EA0F95-0F90-4B0A-9CDB-E2EB8E4773A9",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Recurly Client Python Library before 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1, 2.6.2 is vulnerable to a Server-Side Request Forgery vulnerability in the \"Resource.get\" method that could result in compromise of API keys or other critical resources."
    },
    {
      "lang": "es",
      "value": "La biblioteca de Python Recurly Client en versiones anteriores a la 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1 y 2.6.2 es vulnerable a Server-Side Request Forgery en el m\u00e9todo \"Resource.get\" que podr\u00eda conllevar el compromiso de las claves API o de otros recursos cr\u00edticos."
    }
  ],
  "id": "CVE-2017-0906",
  "lastModified": "2025-04-20T01:37:25.860",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2017-11-13T17:29:00.457",
  "references": [
    {
      "source": "support@hackerone.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://dev.recurly.com/page/python-updates"
    },
    {
      "source": "support@hackerone.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/recurly/recurly-client-python/commit/049c74699ce93cf126feff06d632ea63fba36742"
    },
    {
      "source": "support@hackerone.com",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://hackerone.com/reports/288635"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://dev.recurly.com/page/python-updates"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/recurly/recurly-client-python/commit/049c74699ce93cf126feff06d632ea63fba36742"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://hackerone.com/reports/288635"
    }
  ],
  "sourceIdentifier": "support@hackerone.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "support@hackerone.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2017-0906 (GCVE-0-2017-0906)
Vulnerability from cvelistv5
Published
2017-11-13 17:00
Modified
2024-09-17 00:50
Severity ?
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF) ()
Summary
The Recurly Client Python Library before 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1, 2.6.2 is vulnerable to a Server-Side Request Forgery vulnerability in the "Resource.get" method that could result in compromise of API keys or other critical resources.
References
Impacted products
Vendor Product Version
Recurly recurly python module Version: Versions before 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1, 2.6.2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T13:25:17.078Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/288635"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/recurly/recurly-client-python/commit/049c74699ce93cf126feff06d632ea63fba36742"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://dev.recurly.com/page/python-updates"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "recurly python module",
          "vendor": "Recurly",
          "versions": [
            {
              "status": "affected",
              "version": "Versions before 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1, 2.6.2"
            }
          ]
        }
      ],
      "datePublic": "2017-11-06T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Recurly Client Python Library before 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1, 2.6.2 is vulnerable to a Server-Side Request Forgery vulnerability in the \"Resource.get\" method that could result in compromise of API keys or other critical resources."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF) (CWE-918)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-11-13T16:57:01",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://hackerone.com/reports/288635"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/recurly/recurly-client-python/commit/049c74699ce93cf126feff06d632ea63fba36742"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://dev.recurly.com/page/python-updates"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "support@hackerone.com",
          "DATE_PUBLIC": "2017-11-06T00:00:00",
          "ID": "CVE-2017-0906",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "recurly python module",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Versions before 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1, 2.6.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Recurly"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Recurly Client Python Library before 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1, 2.6.2 is vulnerable to a Server-Side Request Forgery vulnerability in the \"Resource.get\" method that could result in compromise of API keys or other critical resources."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Server-Side Request Forgery (SSRF) (CWE-918)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://hackerone.com/reports/288635",
              "refsource": "MISC",
              "url": "https://hackerone.com/reports/288635"
            },
            {
              "name": "https://github.com/recurly/recurly-client-python/commit/049c74699ce93cf126feff06d632ea63fba36742",
              "refsource": "CONFIRM",
              "url": "https://github.com/recurly/recurly-client-python/commit/049c74699ce93cf126feff06d632ea63fba36742"
            },
            {
              "name": "https://dev.recurly.com/page/python-updates",
              "refsource": "CONFIRM",
              "url": "https://dev.recurly.com/page/python-updates"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2017-0906",
    "datePublished": "2017-11-13T17:00:00Z",
    "dateReserved": "2016-11-30T00:00:00",
    "dateUpdated": "2024-09-17T00:50:41.168Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}