Read the docs
TI-2017-00855 Aliases CVE-2017-0907GHSA-xpwp-rq3x-x6v7

Server-side request forgery in recurly-api-client .NET library

Priority MEDIUM 47CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub.

Summary

The Recurly Client .NET Library before 1.0.1, 1.1.10, 1.2.8, 1.3.2, 1.4.14, 1.5.3, 1.6.2, 1.7.1, 1.8.1 is vulnerable to a Server-Side Request Forgery vulnerability due to incorrect use of "Uri.EscapeUriString" that could result in compromise of API keys or other critical resources.

Why it matters now

EPSS 0.02594 85th percentileScored 2026-11-07
Fix Fixed recurly-api-client (NuGet): 1.0.1, 1.1.10, 1.2.8 +6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Recurlyrecurly-api-client .NET libraryVersions before 1.0.1, 1.1.10, 1.2.8, 1.3.2, 1.4.14, 1.5.3, 1.6.2, 1.7.1, 1.8.1—No fix listedCNA
—recurly-api-client (NuGet)before 1.0.11.0.1Patch availableGHSA-xpwp-rq3x-x6v7
—recurly-api-client (NuGet)1.1.0 to before 1.1.101.1.10Patch availableGHSA-xpwp-rq3x-x6v7
—recurly-api-client (NuGet)1.2.0 to before 1.2.81.2.8Patch availableGHSA-xpwp-rq3x-x6v7
—recurly-api-client (NuGet)1.3.0 to before 1.3.21.3.2Patch availableGHSA-xpwp-rq3x-x6v7
—recurly-api-client (NuGet)1.4.0 to before 1.4.141.4.14Patch availableGHSA-xpwp-rq3x-x6v7
—recurly-api-client (NuGet)1.5.0 to before 1.5.31.5.3Patch availableGHSA-xpwp-rq3x-x6v7
—recurly-api-client (NuGet)1.6.0 to before 1.6.21.6.2Patch availableGHSA-xpwp-rq3x-x6v7
—recurly-api-client (NuGet)1.7.0 to before 1.7.11.7.1Patch availableGHSA-xpwp-rq3x-x6v7
—recurly-api-client (NuGet)1.8.0 to before 1.8.11.8.1Patch availableGHSA-xpwp-rq3x-x6v7
  • recurly-api-client .NET library VendorRecurly Affected Versions before 1.0.1, 1.1.10, 1.2.8, 1.3.2, 1.4.14, 1.5.3, 1.6.2, 1.7.1, 1.8.1 Fixed in — No fix listed CNA
  • recurly-api-client (NuGet) Vendor— Affected before 1.0.1 Fixed in 1.0.1 Patch available GHSA-xpwp-rq3x-x6v7
  • recurly-api-client (NuGet) Vendor— Affected 1.1.0 to before 1.1.10 Fixed in 1.1.10 Patch available GHSA-xpwp-rq3x-x6v7
  • recurly-api-client (NuGet) Vendor— Affected 1.2.0 to before 1.2.8 Fixed in 1.2.8 Patch available GHSA-xpwp-rq3x-x6v7
  • recurly-api-client (NuGet) Vendor— Affected 1.3.0 to before 1.3.2 Fixed in 1.3.2 Patch available GHSA-xpwp-rq3x-x6v7
  • recurly-api-client (NuGet) Vendor— Affected 1.4.0 to before 1.4.14 Fixed in 1.4.14 Patch available GHSA-xpwp-rq3x-x6v7
  • recurly-api-client (NuGet) Vendor— Affected 1.5.0 to before 1.5.3 Fixed in 1.5.3 Patch available GHSA-xpwp-rq3x-x6v7
  • recurly-api-client (NuGet) Vendor— Affected 1.6.0 to before 1.6.2 Fixed in 1.6.2 Patch available GHSA-xpwp-rq3x-x6v7
  • recurly-api-client (NuGet) Vendor— Affected 1.7.0 to before 1.7.1 Fixed in 1.7.1 Patch available GHSA-xpwp-rq3x-x6v7
  • recurly-api-client (NuGet) Vendor— Affected 1.8.0 to before 1.8.1 Fixed in 1.8.1 Patch available GHSA-xpwp-rq3x-x6v7

CPE configurations NVD · 44

CPEVersionsRoleVendor
cpe:2.3:a:recurly:recurly_client_.net:1.0.0:*:*:*:*:*:*:*1.0.0VulnerableRecurly
cpe:2.3:a:recurly:recurly_client_.net:1.0.0:beta1:*:*:*:*:*:*1.0.0 beta1VulnerableRecurly
cpe:2.3:a:recurly:recurly_client_.net:1.0.0:beta2:*:*:*:*:*:*1.0.0 beta2VulnerableRecurly
cpe:2.3:a:recurly:recurly_client_.net:1.0.0:beta3:*:*:*:*:*:*1.0.0 beta3VulnerableRecurly
cpe:2.3:a:recurly:recurly_client_.net:1.0.0:rc1:*:*:*:*:*:*1.0.0 rc1VulnerableRecurly
cpe:2.3:a:recurly:recurly_client_.net:1.0.0.1:*:*:*:*:*:*:*1.0.0.1VulnerableRecurly
cpe:2.3:a:recurly:recurly_client_.net:1.0.0.2:*:*:*:*:*:*:*1.0.0.2VulnerableRecurly
cpe:2.3:a:recurly:recurly_client_.net:1.0.0.3:*:*:*:*:*:*:*1.0.0.3VulnerableRecurly
cpe:2.3:a:recurly:recurly_client_.net:1.0.0.4:*:*:*:*:*:*:*1.0.0.4VulnerableRecurly
cpe:2.3:a:recurly:recurly_client_.net:1.1.0:*:*:*:*:*:*:*1.1.0VulnerableRecurly
  • cpe:2.3:a:recurly:recurly_client_.net:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·Recurly
  • cpe:2.3:a:recurly:recurly_client_.net:1.0.0:beta1:*:*:*:*:*:* Versions 1.0.0 beta1 Vulnerable ·Recurly
  • cpe:2.3:a:recurly:recurly_client_.net:1.0.0:beta2:*:*:*:*:*:* Versions 1.0.0 beta2 Vulnerable ·Recurly
  • cpe:2.3:a:recurly:recurly_client_.net:1.0.0:beta3:*:*:*:*:*:* Versions 1.0.0 beta3 Vulnerable ·Recurly
  • cpe:2.3:a:recurly:recurly_client_.net:1.0.0:rc1:*:*:*:*:*:* Versions 1.0.0 rc1 Vulnerable ·Recurly
  • cpe:2.3:a:recurly:recurly_client_.net:1.0.0.1:*:*:*:*:*:*:* Versions 1.0.0.1 Vulnerable ·Recurly
  • cpe:2.3:a:recurly:recurly_client_.net:1.0.0.2:*:*:*:*:*:*:* Versions 1.0.0.2 Vulnerable ·Recurly
  • cpe:2.3:a:recurly:recurly_client_.net:1.0.0.3:*:*:*:*:*:*:* Versions 1.0.0.3 Vulnerable ·Recurly
  • cpe:2.3:a:recurly:recurly_client_.net:1.0.0.4:*:*:*:*:*:*:* Versions 1.0.0.4 Vulnerable ·Recurly
  • cpe:2.3:a:recurly:recurly_client_.net:1.1.0:*:*:*:*:*:*:* Versions 1.1.0 Vulnerable ·Recurly
Show 34 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:recurly:recurly_client_.net:1.1.1:*:*:*:*:*:*:*1.1.1VulnerableRecurly
cpe:2.3:a:recurly:recurly_client_.net:1.1.4:*:*:*:*:*:*:*1.1.4VulnerableRecurly
cpe:2.3:a:recurly:recurly_client_.net:1.1.5:*:*:*:*:*:*:*1.1.5VulnerableRecurly
cpe:2.3:a:recurly:recurly_client_.net:1.1.6:*:*:*:*:*:*:*1.1.6VulnerableRecurly
cpe:2.3:a:recurly:recurly_client_.net:1.1.7:*:*:*:*:*:*:*1.1.7VulnerableRecurly
cpe:2.3:a:recurly:recurly_client_.net:1.1.8:*:*:*:*:*:*:*1.1.8VulnerableRecurly
cpe:2.3:a:recurly:recurly_client_.net:1.1.9:*:*:*:*:*:*:*1.1.9VulnerableRecurly
cpe:2.3:a:recurly:recurly_client_.net:1.2.0:*:*:*:*:*:*:*1.2.0VulnerableRecurly
cpe:2.3:a:recurly:recurly_client_.net:1.2.1:*:*:*:*:*:*:*1.2.1VulnerableRecurly
cpe:2.3:a:recurly:recurly_client_.net:1.2.2:*:*:*:*:*:*:*1.2.2VulnerableRecurly
cpe:2.3:a:recurly:recurly_client_.net:1.2.5:*:*:*:*:*:*:*1.2.5VulnerableRecurly
cpe:2.3:a:recurly:recurly_client_.net:1.2.6:*:*:*:*:*:*:*1.2.6VulnerableRecurly
cpe:2.3:a:recurly:recurly_client_.net:1.2.7:*:*:*:*:*:*:*1.2.7VulnerableRecurly
cpe:2.3:a:recurly:recurly_client_.net:1.3.0:*:*:*:*:*:*:*1.3.0VulnerableRecurly
cpe:2.3:a:recurly:recurly_client_.net:1.3.1:*:*:*:*:*:*:*1.3.1VulnerableRecurly
cpe:2.3:a:recurly:recurly_client_.net:1.4.0:*:*:*:*:*:*:*1.4.0VulnerableRecurly
cpe:2.3:a:recurly:recurly_client_.net:1.4.1:*:*:*:*:*:*:*1.4.1VulnerableRecurly
cpe:2.3:a:recurly:recurly_client_.net:1.4.2:*:*:*:*:*:*:*1.4.2VulnerableRecurly
cpe:2.3:a:recurly:recurly_client_.net:1.4.3:*:*:*:*:*:*:*1.4.3VulnerableRecurly
cpe:2.3:a:recurly:recurly_client_.net:1.4.4:*:*:*:*:*:*:*1.4.4VulnerableRecurly
cpe:2.3:a:recurly:recurly_client_.net:1.4.5:*:*:*:*:*:*:*1.4.5VulnerableRecurly
cpe:2.3:a:recurly:recurly_client_.net:1.4.6:*:*:*:*:*:*:*1.4.6VulnerableRecurly
cpe:2.3:a:recurly:recurly_client_.net:1.4.7:*:*:*:*:*:*:*1.4.7VulnerableRecurly
cpe:2.3:a:recurly:recurly_client_.net:1.4.8:*:*:*:*:*:*:*1.4.8VulnerableRecurly
cpe:2.3:a:recurly:recurly_client_.net:1.4.9:*:*:*:*:*:*:*1.4.9VulnerableRecurly
cpe:2.3:a:recurly:recurly_client_.net:1.4.10:*:*:*:*:*:*:*1.4.10VulnerableRecurly
cpe:2.3:a:recurly:recurly_client_.net:1.4.11:*:*:*:*:*:*:*1.4.11VulnerableRecurly
cpe:2.3:a:recurly:recurly_client_.net:1.4.12:*:*:*:*:*:*:*1.4.12VulnerableRecurly
cpe:2.3:a:recurly:recurly_client_.net:1.4.13:*:*:*:*:*:*:*1.4.13VulnerableRecurly
cpe:2.3:a:recurly:recurly_client_.net:1.5.0:*:*:*:*:*:*:*1.5.0VulnerableRecurly
cpe:2.3:a:recurly:recurly_client_.net:1.6.0:*:*:*:*:*:*:*1.6.0VulnerableRecurly
cpe:2.3:a:recurly:recurly_client_.net:1.6.1:*:*:*:*:*:*:*1.6.1VulnerableRecurly
cpe:2.3:a:recurly:recurly_client_.net:1.7.0:*:*:*:*:*:*:*1.7.0VulnerableRecurly
cpe:2.3:a:recurly:recurly_client_.net:1.8.0:*:*:*:*:*:*:*1.8.0VulnerableRecurly
  • cpe:2.3:a:recurly:recurly_client_.net:1.1.1:*:*:*:*:*:*:* Versions 1.1.1 Vulnerable ·Recurly
  • cpe:2.3:a:recurly:recurly_client_.net:1.1.4:*:*:*:*:*:*:* Versions 1.1.4 Vulnerable ·Recurly
  • cpe:2.3:a:recurly:recurly_client_.net:1.1.5:*:*:*:*:*:*:* Versions 1.1.5 Vulnerable ·Recurly
  • cpe:2.3:a:recurly:recurly_client_.net:1.1.6:*:*:*:*:*:*:* Versions 1.1.6 Vulnerable ·Recurly
  • cpe:2.3:a:recurly:recurly_client_.net:1.1.7:*:*:*:*:*:*:* Versions 1.1.7 Vulnerable ·Recurly
  • cpe:2.3:a:recurly:recurly_client_.net:1.1.8:*:*:*:*:*:*:* Versions 1.1.8 Vulnerable ·Recurly
  • cpe:2.3:a:recurly:recurly_client_.net:1.1.9:*:*:*:*:*:*:* Versions 1.1.9 Vulnerable ·Recurly
  • cpe:2.3:a:recurly:recurly_client_.net:1.2.0:*:*:*:*:*:*:* Versions 1.2.0 Vulnerable ·Recurly
  • cpe:2.3:a:recurly:recurly_client_.net:1.2.1:*:*:*:*:*:*:* Versions 1.2.1 Vulnerable ·Recurly
  • cpe:2.3:a:recurly:recurly_client_.net:1.2.2:*:*:*:*:*:*:* Versions 1.2.2 Vulnerable ·Recurly
  • cpe:2.3:a:recurly:recurly_client_.net:1.2.5:*:*:*:*:*:*:* Versions 1.2.5 Vulnerable ·Recurly
  • cpe:2.3:a:recurly:recurly_client_.net:1.2.6:*:*:*:*:*:*:* Versions 1.2.6 Vulnerable ·Recurly
  • cpe:2.3:a:recurly:recurly_client_.net:1.2.7:*:*:*:*:*:*:* Versions 1.2.7 Vulnerable ·Recurly
  • cpe:2.3:a:recurly:recurly_client_.net:1.3.0:*:*:*:*:*:*:* Versions 1.3.0 Vulnerable ·Recurly
  • cpe:2.3:a:recurly:recurly_client_.net:1.3.1:*:*:*:*:*:*:* Versions 1.3.1 Vulnerable ·Recurly
  • cpe:2.3:a:recurly:recurly_client_.net:1.4.0:*:*:*:*:*:*:* Versions 1.4.0 Vulnerable ·Recurly
  • cpe:2.3:a:recurly:recurly_client_.net:1.4.1:*:*:*:*:*:*:* Versions 1.4.1 Vulnerable ·Recurly
  • cpe:2.3:a:recurly:recurly_client_.net:1.4.2:*:*:*:*:*:*:* Versions 1.4.2 Vulnerable ·Recurly
  • cpe:2.3:a:recurly:recurly_client_.net:1.4.3:*:*:*:*:*:*:* Versions 1.4.3 Vulnerable ·Recurly
  • cpe:2.3:a:recurly:recurly_client_.net:1.4.4:*:*:*:*:*:*:* Versions 1.4.4 Vulnerable ·Recurly
  • cpe:2.3:a:recurly:recurly_client_.net:1.4.5:*:*:*:*:*:*:* Versions 1.4.5 Vulnerable ·Recurly
  • cpe:2.3:a:recurly:recurly_client_.net:1.4.6:*:*:*:*:*:*:* Versions 1.4.6 Vulnerable ·Recurly
  • cpe:2.3:a:recurly:recurly_client_.net:1.4.7:*:*:*:*:*:*:* Versions 1.4.7 Vulnerable ·Recurly
  • cpe:2.3:a:recurly:recurly_client_.net:1.4.8:*:*:*:*:*:*:* Versions 1.4.8 Vulnerable ·Recurly
  • cpe:2.3:a:recurly:recurly_client_.net:1.4.9:*:*:*:*:*:*:* Versions 1.4.9 Vulnerable ·Recurly
  • cpe:2.3:a:recurly:recurly_client_.net:1.4.10:*:*:*:*:*:*:* Versions 1.4.10 Vulnerable ·Recurly
  • cpe:2.3:a:recurly:recurly_client_.net:1.4.11:*:*:*:*:*:*:* Versions 1.4.11 Vulnerable ·Recurly
  • cpe:2.3:a:recurly:recurly_client_.net:1.4.12:*:*:*:*:*:*:* Versions 1.4.12 Vulnerable ·Recurly
  • cpe:2.3:a:recurly:recurly_client_.net:1.4.13:*:*:*:*:*:*:* Versions 1.4.13 Vulnerable ·Recurly
  • cpe:2.3:a:recurly:recurly_client_.net:1.5.0:*:*:*:*:*:*:* Versions 1.5.0 Vulnerable ·Recurly
  • cpe:2.3:a:recurly:recurly_client_.net:1.6.0:*:*:*:*:*:*:* Versions 1.6.0 Vulnerable ·Recurly
  • cpe:2.3:a:recurly:recurly_client_.net:1.6.1:*:*:*:*:*:*:* Versions 1.6.1 Vulnerable ·Recurly
  • cpe:2.3:a:recurly:recurly_client_.net:1.7.0:*:*:*:*:*:*:* Versions 1.7.0 Vulnerable ·Recurly
  • cpe:2.3:a:recurly:recurly_client_.net:1.8.0:*:*:*:*:*:*:* Versions 1.8.0 Vulnerable ·Recurly

Remediation

  • Fix · GHSA-xpwp-rq3x-x6v7 recurly-api-client (NuGet) Fixed in 1.0.1 Advisory →
  • Fix · GHSA-xpwp-rq3x-x6v7 recurly-api-client (NuGet) Fixed in 1.1.10 Advisory →
  • Fix · GHSA-xpwp-rq3x-x6v7 recurly-api-client (NuGet) Fixed in 1.2.8 Advisory →
  • Fix · GHSA-xpwp-rq3x-x6v7 recurly-api-client (NuGet) Fixed in 1.3.2 Advisory →
  • Fix · GHSA-xpwp-rq3x-x6v7 recurly-api-client (NuGet) Fixed in 1.4.14 Advisory →
  • Fix · GHSA-xpwp-rq3x-x6v7 recurly-api-client (NuGet) Fixed in 1.5.3 Advisory →
  • Fix · GHSA-xpwp-rq3x-x6v7 recurly-api-client (NuGet) Fixed in 1.6.2 Advisory →
  • Fix · GHSA-xpwp-rq3x-x6v7 recurly-api-client (NuGet) Fixed in 1.7.1 Advisory →
  • Fix · GHSA-xpwp-rq3x-x6v7 recurly-api-client (NuGet) Fixed in 1.8.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-0907
  2. 2026-10-03 Alias added: GHSA-xpwp-rq3x-x6v7

References

Patch 1

Advisory 3

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences