Skip to content
Fencer Vulns
critical 9.8

CVE-2017-0905 json

Recurly gem Server-Side Request Forgery in Resource#find method

published 2017-11-13 8 y ago modified 2026-06-17 4 mo ago also GHSA-x27v-x225-gq8g , EUVD-2017-0367

cvss
9.8
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.6%
EPSS 2.6% chance of exploitation in 30 days, percentile 85%
public exploits
0
none known

Summary

The Recurly Client Ruby Library before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3 is vulnerable to a Server-Side Request Forgery vulnerability in the "Resource#find" method that could result in compromise of API keys or other critical resources.

Patch / fix

  • rubygems recurly 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3

Exploit prediction

2.59% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.0 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub 3.0 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
rubygems recurly
>=2.3.0, <2.3.10
>=2.2.0, <2.2.5
>=2.1.0, <2.1.11
>=2.0.0, <2.0.13
>=2.9.0, <2.9.2
>=2.8.0, <2.8.2
>=2.7.0, <2.7.8
>=2.6.0, <2.6.3
>=2.5.0, <2.5.4
>=2.4.0, <2.4.11
>=2.11.0, <2.11.3
>=2.10.0, <2.10.4
2.3.10
2.2.5
2.1.11
2.0.13
2.9.2
2.8.2
2.7.8
2.6.3
2.5.4
2.4.11
2.11.3
2.10.4

Affected products

  • Recurly recurly ruby gem

Classification

Weakness
  • CWE-918 Server-Side Request Forgery

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.