{"id":"CVE-2017-0905","details":"The Recurly Client Ruby Library before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3 is vulnerable to a Server-Side Request Forgery vulnerability in the \"Resource#find\" method that could result in compromise of API keys or other critical resources.","aliases":["GHSA-x27v-x225-gq8g"],"modified":"2026-05-18T05:48:25.384565768Z","published":"2017-11-13T17:29:00.427Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"last_affected":"2.7.0"}],"source":"CPE_FIELD","vendor_product":"recurly:recurly_client_ruby","cpes":["cpe:2.3:a:recurly:recurly_client_ruby:2.7.0:*:*:*:*:*:*:*"]}]},"references":[{"type":"ADVISORY","url":"https://dev.recurly.com/page/ruby-updates"},{"type":"REPORT","url":"https://hackerone.com/reports/288635"},{"type":"FIX","url":"https://github.com/recurly/recurly-client-ruby/commit/1bb0284d6e668b8b3d31167790ed6db1f6ccc4be"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/recurly/recurly-client-ruby","events":[{"introduced":"0"},{"last_affected":"1acced7cd892154c07fdbc1620f461c7ac667d16"},{"last_affected":"285c3d00d2636e9661c040e9c033b5ae1a1704fd"},{"last_affected":"8db598170a16e48f37d9ef4519f1ac6e962e71dd"},{"last_affected":"fa9fa803e7e0a5c5ec245d0350f5c5f80d01a480"},{"last_affected":"93a7e8274ee3b0dcc2a58728064f8189ec3b2247"},{"last_affected":"ade31c607ea5aa9ea4556e191ad35bd3749262f4"},{"last_affected":"fe4ea181e4b814bba986f08e2aee6bf5047c250f"},{"last_affected":"97dc2d0680a7fe2363d9e831909241e573717f18"},{"last_affected":"909a7ad5d6523e1deb8a84141e58b2f26149e8f0"},{"last_affected":"a3b650a12e558bd8c3d241ada416784864f7ec74"},{"last_affected":"67d3bab91c27825be4981792fc6ccc3532552d5a"},{"last_affected":"d5131d820d63ee0876ac912b22558f5d2c3cd772"},{"last_affected":"b3b36d08f0d700647ded68940e12ca61a3e56e0f"},{"last_affected":"3fe8093b79c3c050bd2ea8651265f83b53c1c150"},{"last_affected":"eae1a07e855875b8c9139254d560062d9e34c867"},{"last_affected":"3d07ba1407a7a2348ab7f2b21f9798e05e66b307"},{"last_affected":"7d0d5dcb9e997f92ed13cf05479af1a90d8fc644"},{"last_affected":"83fa9d2715e7e1172877f0f51108456f6411e367"},{"last_affected":"646846b543000321e27123534b73b7ab9c56aa9b"},{"last_affected":"b3ea3360bbd65bf8b36bfca2a4b4e161f201e9ed"},{"last_affected":"6f5ae62302fa185e1a99937d5294e5d3300fa72a"},{"last_affected":"495743ae74ee9d839e90d03c3fac9bf321b22343"},{"last_affected":"6ce9c4f85b9b8dda37b2abef1445ee1f0e38e98a"},{"last_affected":"e6c91ae30e1b973380e207dd355b6a2bfdda949c"},{"last_affected":"184fa175a99e887d194ef95aed5cde4b8f7556be"},{"last_affected":"2d34f4ea1d3ebd3a0be5f062ba099e0858c0461d"},{"last_affected":"688c87d06f5d5603dd418236dc134e5c1783e4e9"},{"last_affected":"f458eecd48ac4fb73157eed2f3d021cdbe4b6542"},{"last_affected":"a897d9b5b7224f282b265b6cf4c88a8e3f8c2679"},{"last_affected":"efa08dfa23aa60fcee4f3fce71500c2258de2f64"},{"last_affected":"a79f427d99988dc3a8526946ebd6e76e7f9cf214"},{"last_affected":"126841ac0099fe4d302aa5e957df8ba998386f5e"},{"last_affected":"2adbac0046cf082357ac944eb15f2a6e33bfb56c"},{"last_affected":"fbd5b5b298e76a80c09210fe70a4c20ff219b9cb"},{"last_affected":"f515bfbc537cc12e22d3009d8bc1a99138fb47a6"},{"last_affected":"b40dc39fe79afbe4aec1b3c83759ae4e5c71ef4b"},{"last_affected":"2a07c141023b9489729e7939d7d02c16e915facc"},{"last_affected":"d3bd34d54c0d586e8c0e30e1cfcaa21fc21b31af"},{"last_affected":"e8df5a3c5d0cb572a3c0e19725691c80eb976846"},{"last_affected":"770e5b8ce43e2c6dd8043ee0a4d6556dcf936ed4"},{"last_affected":"8831e48b6c242f529187dbd63ed985372420c9dd"},{"last_affected":"b05a96f8159133681397ada4a0b1bb9da5937a6d"},{"last_affected":"17de82800ba43783291c72f6692205fb9d35ee71"},{"last_affected":"8c1bf17349c61708f12acc6741b9398bc08b8d8a"},{"last_affected":"9a0e2d96a45a3141f42f62db0c411b67d9d370d2"},{"last_affected":"ba9014b8fd2bfc44c79a46d820bcd841ec030411"},{"last_affected":"1e3278a5190449e175cb7724904ba517ec2277b9"},{"last_affected":"137e3f4193618ae49b2739b88e4322ed604586dc"},{"last_affected":"4d40a4b873b5e403550ac2419eea720bd05bb6a1"},{"last_affected":"0255daec70a4db6812f14628df2fdcc6f6ede478"},{"last_affected":"1d6e8ea9cef95abfdf97eb18ae6367de275b33ec"},{"last_affected":"90cadbc058b25ea6aef8ba2dff898e1e1106ab19"},{"last_affected":"ef83ababe2d8ffe094dc780634f8edb6484be822"},{"last_affected":"35b85ec56ff55973d70e4408c0af3b94affd03d5"},{"last_affected":"d6145a74af75b20b70a5212d7ce5537f4a6e521a"},{"last_affected":"99d03c7507f18a263c12ed55878e88112fae1161"},{"last_affected":"206f89fc48301cd9a8a34079e57094a8ba3aa7bc"},{"last_affected":"10d5aa037c8a9a4e59c8a32a24fb634085e72302"},{"last_affected":"bf900f4b4f8cac89755e5ac08969a6727bf493bb"},{"last_affected":"2e3c3f121be608edab4b592b0d4cccb965c1fd16"},{"last_affected":"1244236bb12530532b8e067a922e48e770e50895"},{"last_affected":"50c75a34c2893886027fae904ffa9e7b5744789d"},{"last_affected":"66b33589c7179322fc94e4e3bb5e852f13234027"},{"last_affected":"c8ea7b7c6ede3cea0401df645dc54b88eb8a7465"},{"last_affected":"8f7e84ee628bdcc47d3270abe2fa754a0014d6dd"},{"last_affected":"768abc120c9bf3a0b1e615fcb62b685bc296d4f8"},{"last_affected":"11bbb2a2d10a6f4f2894822fa51af82787f995a3"},{"last_affected":"e4b74bc6cef09debb8189d1f62492d948b55ebd5"},{"last_affected":"1e1b40ba949b2a2a0f6f898d72f92ab1368a20ca"},{"last_affected":"75c068097c813714eddecdf4d57eb77bbd88b432"},{"last_affected":"575d1cc4d7f56a7de6319b5e7c557c7d93b3302c"},{"last_affected":"d65899deb0dc3f586b472715d3cd34e262c39c9e"},{"last_affected":"ceec6a4e5c9f54857912c0e1423bb7dc673903ce"},{"last_affected":"5f16c0bd34395ebd534a8b46befc100714baa05b"},{"last_affected":"7af889e3e5e376b4839da5189d3cab8847e50253"},{"last_affected":"24c5410115b0d780f1c9340ad6e9baf0ac8460b1"},{"last_affected":"08c4766b75b286193fcd41421d9303fc4d18f1c0"}],"database_specific":{"cpe":["cpe:2.3:a:recurly:recurly_client_ruby:2.0.0:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.0.1:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.0.2:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.0.3:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.0.4:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.0.5:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.0.6:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.0.7:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.0.8:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.0.9:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.0.10:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.0.11:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.0.12:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.1.0:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.1.0:c:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.1.3:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.1.4:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.1.5:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.1.6:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.1.7:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.1.8:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.1.9:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.1.10:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.2.0:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.2.1:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.2.2:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.2.3:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.2.4:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.3.0:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.3.0:beta1:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.3.1:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.3.3:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.3.4:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.3.5:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.3.6:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.3.7:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.3.8:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.3.9:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.4.0:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.4.1:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.4.2:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.4.3:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.4.4:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.4.5:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.4.6:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.4.7:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.4.8:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.4.9:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.4.10:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.5.1:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.5.2:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.5.3:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.6.0:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.6.1:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.6.2:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.7.1:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.7.2:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.7.3:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.7.4:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.7.5:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.7.6:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.7.7:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.8.0:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.8.0:rc1:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.8.0:rc3:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.8.1:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.9.0:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.9.1:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.10.0:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.10.1:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.10.2:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.10.3:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.11.0:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.11.1:*:*:*:*:*:*:*","cpe:2.3:a:recurly:recurly_client_ruby:2.11.2:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0"},{"last_affected":"2.0.0"},{"last_affected":"2.0.1"},{"last_affected":"2.0.2"},{"last_affected":"2.0.3"},{"last_affected":"2.0.4"},{"last_affected":"2.0.5"},{"last_affected":"2.0.6"},{"last_affected":"2.0.7"},{"last_affected":"2.0.8"},{"last_affected":"2.0.9"},{"last_affected":"2.0.10"},{"last_affected":"2.0.11"},{"last_affected":"2.0.12"},{"last_affected":"2.1.0"},{"last_affected":"2.1.0-c"},{"last_affected":"2.1.1"},{"last_affected":"2.1.2"},{"last_affected":"2.1.3"},{"last_affected":"2.1.4"},{"last_affected":"2.1.5"},{"last_affected":"2.1.6"},{"last_affected":"2.1.7"},{"last_affected":"2.1.8"},{"last_affected":"2.1.9"},{"last_affected":"2.1.10"},{"last_affected":"2.2.0"},{"last_affected":"2.2.1"},{"last_affected":"2.2.2"},{"last_affected":"2.2.3"},{"last_affected":"2.2.4"},{"last_affected":"2.3.0"},{"last_affected":"2.3.0-beta1"},{"last_affected":"2.3.1"},{"last_affected":"2.3.2"},{"last_affected":"2.3.3"},{"last_affected":"2.3.4"},{"last_affected":"2.3.5"},{"last_affected":"2.3.6"},{"last_affected":"2.3.7"},{"last_affected":"2.3.8"},{"last_affected":"2.3.9"},{"last_affected":"2.4.0"},{"last_affected":"2.4.1"},{"last_affected":"2.4.2"},{"last_affected":"2.4.3"},{"last_affected":"2.4.4"},{"last_affected":"2.4.5"},{"last_affected":"2.4.6"},{"last_affected":"2.4.7"},{"last_affected":"2.4.8"},{"last_affected":"2.4.9"},{"last_affected":"2.4.10"},{"last_affected":"2.5.0"},{"last_affected":"2.5.1"},{"last_affected":"2.5.2"},{"last_affected":"2.5.3"},{"last_affected":"2.6.0"},{"last_affected":"2.6.1"},{"last_affected":"2.6.2"},{"last_affected":"2.7.1"},{"last_affected":"2.7.2"},{"last_affected":"2.7.3"},{"last_affected":"2.7.4"},{"last_affected":"2.7.5"},{"last_affected":"2.7.6"},{"last_affected":"2.7.7"},{"last_affected":"2.8.0"},{"last_affected":"2.8.0-rc1"},{"last_affected":"2.8.0-rc3"},{"last_affected":"2.8.1"},{"last_affected":"2.9.0"},{"last_affected":"2.9.1"},{"last_affected":"2.10.0"},{"last_affected":"2.10.1"},{"last_affected":"2.10.2"},{"last_affected":"2.10.3"},{"last_affected":"2.11.0"},{"last_affected":"2.11.1"},{"last_affected":"2.11.2"}],"source":"CPE_FIELD"}}],"versions":["2.9.1","2.8.1","2.7.7","2.6.2","2.5.3","2.4.10","2.3.9","2.2.4","2.1.10","2.0.12","2.10.3","2.11.2","2.0.11","v2.6.1","2.6.1","2.8.0","2.9.0","2.11.1","2.11.0","2.10.2","2.10.1","2.10.0","2.8.0.rc3","2.7.6","2.8.0.rc1","2.7.5","2.7.4","v2.7.3","2.7.3","2.7.2","2.7.1","v2.6.0","2.6.0","2.5.2","2.5.1","2.5.0","2.4.9","2.4.8","2.4.7","v2.4.6","2.4.6","2.4.5","2.4.4","2.4.3","2.4.2","2.4.1","2.4.0","2.3.8","2.3.7","2.3.6","2.3.5","v2.3.4","2.3.4","2.3.3","2.3.2","2.3.0","2.3.1","2.2.3","2.2.2","2.3.0.beta1","2.2.1","2.2.0","2.1.9","2.1.8","2.1.7","2.1.6","2.1.5","2.1.4","2.1.3","2.1.2","2.1.1","2.1.0c","2.1.0","2.0.10","2.0.9","2.0.8","2.0.7","2.0.6","2.0.5","2.0.4","2.0.3","2.0.2","2.0.1","2.0.0"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-0905.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}