GitHub Advisoryadvisory · NuGet

GHSA-xpwp-rq3x-x6v7 Critical severity vulnerability that affects recurly-api-client

CRITICAL Published 2018-10-16 Modified 2020-06-16 Official page ↗
Aliases
CVE-2017-0907
Ecosystem
NuGet
Packages
recurly-api-client
Severity
Critical
Weaknesses
CWE-918
Reviewed
2020-06-16

Affected packages

• NuGet recurly-api-client: < 1.0.1 → fixed in 1.0.1 • NuGet recurly-api-client: >= 1.1.0, < 1.1.10 → fixed in 1.1.10 • NuGet recurly-api-client: >= 1.2.0, < 1.2.8 → fixed in 1.2.8 • NuGet recurly-api-client: >= 1.3.0, < 1.3.2 → fixed in 1.3.2 • NuGet recurly-api-client: >= 1.4.0, < 1.4.14 → fixed in 1.4.14 • NuGet recurly-api-client: >= 1.5.0, < 1.5.3 → fixed in 1.5.3 • NuGet recurly-api-client: >= 1.6.0, < 1.6.2 → fixed in 1.6.2 • NuGet recurly-api-client: >= 1.7.0, < 1.7.1 → fixed in 1.7.1 • NuGet recurly-api-client: >= 1.8.0, < 1.8.1 → fixed in 1.8.1

Description

The Recurly Client .NET Library before 1.0.1, 1.1.10, 1.2.8, 1.3.2, 1.4.14, 1.5.3, 1.6.2, 1.7.1, 1.8.1 is vulnerable to a Server-Side Request Forgery vulnerability due to incorrect use of "Uri.EscapeUriString" that could result in compromise of API keys or other critical resources.

Related

Alias · CVE (1)

  • CVE-2017-0907 The Recurly Client .NET Library before 1.0.1, 1.1.10, 1.2.8, 1.3.2, 1.4.14, 1.5.3, 1.6.2, 1.7.1, 1.8.1 is vulnerable to a Server-Side… vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References