CVE-2017-0905

9.8 criticalEPSS 2.6%

Critical (9.8) in recurly recurly client ruby. EPSS 2.6% chance of exploitation in the next 30 days. Fixed in recurly 2.0.13, 2.1.11, 2.10.4.

The Recurly Client Ruby Library before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3 is vulnerable to a Server-Side Request Forgery vulnerability in the "Resource#find" method that could result in compromise of API keys or other critical resources.

Severity

CVSS 3.0

9.8 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.6% chance of exploitation in the next 30 days; higher than 85% of CVEs (scores of 2026-10-31)
CWE: CWE-918
Published: 2017-11-13
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

recurly:recurly_client_ruby

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-x27v-x225-gq8g	RubyGems	recurly	>=2.3.0 <2.3.10	2.3.10
GHSA-x27v-x225-gq8g	RubyGems	recurly	>=2.2.0 <2.2.5	2.2.5
GHSA-x27v-x225-gq8g	RubyGems	recurly	>=2.1.0 <2.1.11	2.1.11
GHSA-x27v-x225-gq8g	RubyGems	recurly	>=2.0.0 <2.0.13	2.0.13
GHSA-x27v-x225-gq8g	RubyGems	recurly	>=2.9.0 <2.9.2	2.9.2
GHSA-x27v-x225-gq8g	RubyGems	recurly	>=2.8.0 <2.8.2	2.8.2
GHSA-x27v-x225-gq8g	RubyGems	recurly	>=2.7.0 <2.7.8	2.7.8
GHSA-x27v-x225-gq8g	RubyGems	recurly	>=2.6.0 <2.6.3	2.6.3
GHSA-x27v-x225-gq8g	RubyGems	recurly	>=2.5.0 <2.5.4	2.5.4
GHSA-x27v-x225-gq8g	RubyGems	recurly	>=2.4.0 <2.4.11	2.4.11
GHSA-x27v-x225-gq8g	RubyGems	recurly	>=2.11.0 <2.11.3	2.11.3
GHSA-x27v-x225-gq8g	RubyGems	recurly	>=2.10.0 <2.10.4	2.10.4

References

Check your stack JSON