CVE-2017-0906

Name: CVE-2017-0906
Creator: NVD / NIST
Published: 2017-11-13T17:29:00.457+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 2.59%

Last modified Jun 17, 2026

CVE-2017-0906 is a vulnerability of currently unknown severity. The Recurly Client Python Library before 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1, 2.6.2 is vulnerable to a Server-Side Request Forgery vulnerability in the "Resource.get" method that could result in compromise of API keys or other critical resources.. EPSS estimates a 2.59% chance of exploitation in the next 30 days.

Description

The Recurly Client Python Library before 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1, 2.6.2 is vulnerable to a Server-Side Request Forgery vulnerability in the "Resource.get" method that could result in compromise of API keys or other critical resources.

Metrics

EPSS Probability

2.59%

83.3th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Recurly	Recurly Client Python	>= 2.0.0, <= 2.0.4
Recurly	Recurly Client Python	>= 2.1.0, <= 2.1.15
Recurly	Recurly Client Python	>= 2.2.0, <= 2.2.21
Recurly	Recurly Client Python	2.3.0
Recurly	Recurly Client Python	>= 2.4.0, <= 2.4.4
Recurly	Recurly Client Python	2.5.0
Recurly	Recurly Client Python	2.6.0
Recurly	Recurly Client Python	2.6.1

References

https://dev.recurly.com/page/python-updatesVendor Advisory
https://github.com/recurly/recurly-client-python/commit/049c74699ce93cf126feff06d632ea63fba36742Patch, Third Party Advisory
https://hackerone.com/reports/288635Permissions Required
https://dev.recurly.com/page/python-updatesVendor Advisory
https://github.com/recurly/recurly-client-python/commit/049c74699ce93cf126feff06d632ea63fba36742Patch, Third Party Advisory
https://hackerone.com/reports/288635Permissions Required

Timeline

Published: Nov 13, 2017
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2017-0906?

How severe is CVE-2017-0906?

Severity scoring for CVE-2017-0906 is pending analysis. The EPSS model estimates a 2.59% probability of exploitation in the next 30 days.

How do I fix CVE-2017-0906?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2017-0906?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST