{"action":"Upgrade recurly to 2.0.13 or later.","affected":[{"fixed":"2.3.10","introduced":"2.3.0"},{"fixed":"2.2.5","introduced":"2.2.0"},{"fixed":"2.1.11","introduced":"2.1.0"},{"fixed":"2.0.13","introduced":"2.0.0"},{"fixed":"2.9.2","introduced":"2.9.0"},{"fixed":"2.8.2","introduced":"2.8.0"},{"fixed":"2.7.8","introduced":"2.7.0"},{"fixed":"2.6.3","introduced":"2.6.0"},{"fixed":"2.5.4","introduced":"2.5.0"},{"fixed":"2.4.11","introduced":"2.4.0"},{"fixed":"2.11.3","introduced":"2.11.0"},{"fixed":"2.10.4","introduced":"2.10.0"}],"component":"recurly","cve_ids":["CVE-2017-0905"],"ecosystem":"RubyGems","epss":0.02594,"exploited":false,"fixed_versions":["2.3.10","2.2.5","2.1.11","2.0.13","2.9.2","2.8.2","2.7.8","2.6.3","2.5.4","2.4.11","2.11.3","2.10.4"],"ghsa_id":"GHSA-x27v-x225-gq8g","id":"tcs_01M5KEP2Y3VJ1XJY9CMPEMKKAT","modified_at":"2024-02-16T08:21:56.684023Z","published_at":"2017-12-06T16:43:00Z","references":["https://osv.dev/vulnerability/GHSA-x27v-x225-gq8g","https://nvd.nist.gov/vuln/detail/CVE-2017-0905","https://github.com/recurly/recurly-client-ruby/commit/1bb0284d6e668b8b3d31167790ed6db1f6ccc4be","https://hackerone.com/reports/288635","https://github.com/recurly/recurly-client-ruby","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/recurly/CVE-2017-0905.yml"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-x27v-x225-gq8g","url":"https://osv.dev/vulnerability/GHSA-x27v-x225-gq8g"}],"summary":"Recurly gem Server-Side Request Forgery in Resource#find method"}