CVE-2017-0907
N/A
Published: November 13, 2017 at 05:00 PM UTC
Updated: June 17, 2026 at 12:58 AM UTC
1 product affected across 1 vendorRecurly Client .net
Using recurly-api-client .NET library by Recurly?
Get instant alerts when new vulnerabilities affect recurly-api-client .NET library - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
N/A
Exploit prediction
EPSS 3%
Description
The Recurly Client .NET Library before 1.0.1, 1.1.10, 1.2.8, 1.3.2, 1.4.14, 1.5.3, 1.6.2, 1.7.1, 1.8.1 is vulnerable to a Server-Side Request Forgery vulnerability due to incorrect use of "Uri.EscapeUriString" that could result in compromise of API keys or other critical resources.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
v < 1.0.11.0.01.0.0 beta11.0.0 beta21.0.0 beta31.0.0 rc11.0.0.11.0.0.21.0.0.31.0.0.41.1.01.1.11.1.41.1.51.1.61.1.71.1.81.1.91.2.01.2.11.2.21.2.51.2.61.2.71.3.01.3.11.4.01.4.11.4.101.4.111.4.121.4.131.4.21.4.31.4.41.4.51.4.61.4.71.4.81.4.91.5.01.6.01.6.11.7.01.8.0
Affected range stops below 1.0.1, so it looks safe — our inference, not a vendor statement
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
References (3)
x_refsource_CONFIRMPatchThird Party Advisory
Source: [email protected]
https://github.com/recurly/recurly-client-net/commit/9eef460c0084afd5c24d66220c8b7a381cf9a1f1Quick Info
StatusMODIFIED
CWE
CWE-918
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card