{"id":"CVE-2017-0906","details":"The Recurly Client Python Library before 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1, 2.6.2 is vulnerable to a Server-Side Request Forgery vulnerability in the \"Resource.get\" method that could result in compromise of API keys or other critical resources.","aliases":["GHSA-38rv-5jqc-m2cv","PYSEC-2017-68"],"modified":"2026-07-08T12:53:54.785310Z","published":"2017-11-13T17:29:00.457Z","references":[{"type":"ADVISORY","url":"https://dev.recurly.com/page/python-updates"},{"type":"REPORT","url":"https://hackerone.com/reports/288635"},{"type":"FIX","url":"https://github.com/recurly/recurly-client-python/commit/049c74699ce93cf126feff06d632ea63fba36742"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/recurly/recurly-client-python","events":[{"introduced":"a0c30bd875d44d5c180b6b2e0d40343ff0f76be4"},{"last_affected":"f7c1ef33a72b84135d895d9a9a04fb7861a9741e"},{"introduced":"0ea4aee2318029ffe8f578cb7159773fb1df3d9f"},{"last_affected":"9836471159eb129a7c9e31184f2d52f3a98a7489"},{"introduced":"076b9e67d833509ec03068df49bccd8ab7635d2a"},{"last_affected":"45414c17f794cb3fe90feb09d9f50f3564a701de"},{"introduced":"bc6c3247803919b5ed368b3c6cf1474e1c974568"},{"last_affected":"fabd88e8198eb59975f4a6835578078bdd1bd9fa"},{"introduced":"f03d9e201ef6087d2b5c5bcd033b52cd6141b6d7"},{"last_affected":"9db2d1a0268201571a567d73481d0d16c6fbc5e1"},{"fixed":"049c74699ce93cf126feff06d632ea63fba36742"}],"database_specific":{"cpe":["cpe:2.3:a:recurly:recurly_client_python:*:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_python:2.3.0:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_python:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_python:2.6.0:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_python:2.6.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"2.0.0"},{"last_affected":"2.0.4"},{"introduced":"2.1.0"},{"last_affected":"2.1.15"},{"introduced":"2.2.0"},{"last_affected":"2.2.21"},{"introduced":"2.4.0"},{"last_affected":"2.4.4"},{"introduced":"2.3.0"},{"last_affected":"2.3.0"},{"introduced":"2.5.0"},{"last_affected":"2.5.0"},{"introduced":"2.6.0"},{"last_affected":"2.6.0"},{"introduced":"2.6.1"},{"last_affected":"2.6.1"}],"source":["CPE_RANGE","CPE_STRING","REFERENCES"]}}],"versions":["2.3.0","2.5.0","2.6.0","2.6.1","2.4.4","2.2.21","2.1.15","2.0.4","2.4.3","2.4.2","2.4.1","2.4.0","2.2.20","2.2.19","2.2.18","2.2.17","2.2.16","2.2.15","2.2.14","2.2.13","2.2.12","2.2.11","2.2.10","2.2.9","2.2.8","2.2.7","2.2.6","2.2.4","2.2.3","2.2.2","2.2.1","2.2.0","2.1.14","2.1.12","2.1.4","2.1.3","2.1.2","2.1.1","2.1.0","2.0.3","2.0.2","2.0.1","2.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-0906.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}