Description
The Recurly Client .NET Library before 1.0.1, 1.1.10, 1.2.8, 1.3.2, 1.4.14, 1.5.3, 1.6.2, 1.7.1, 1.8.1 is vulnerable to a Server-Side Request Forgery vulnerability due to incorrect use of "Uri.EscapeUriString" that could result in compromise of API keys or other critical resources.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Recurly | recurly-api-client .NET library | Versions before 1.0.1, 1.1.10, 1.2.8, 1.3.2, 1.4.14, 1.5.3, 1.6.2, 1.7.1, 1.8.1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| NuGet | recurly-api-client | < 1.0.1 | 1.0.1 | GHSA-xpwp-rq3x-x6v7 |
| NuGet | recurly-api-client | >= 1.1.0, < 1.1.10 | 1.1.10 | GHSA-xpwp-rq3x-x6v7 |
| NuGet | recurly-api-client | >= 1.2.0, < 1.2.8 | 1.2.8 | GHSA-xpwp-rq3x-x6v7 |
| NuGet | recurly-api-client | >= 1.3.0, < 1.3.2 | 1.3.2 | GHSA-xpwp-rq3x-x6v7 |
| NuGet | recurly-api-client | >= 1.4.0, < 1.4.14 | 1.4.14 | GHSA-xpwp-rq3x-x6v7 |
| NuGet | recurly-api-client | >= 1.5.0, < 1.5.3 | 1.5.3 | GHSA-xpwp-rq3x-x6v7 |
| NuGet | recurly-api-client | >= 1.6.0, < 1.6.2 | 1.6.2 | GHSA-xpwp-rq3x-x6v7 |
| NuGet | recurly-api-client | >= 1.7.0, < 1.7.1 | 1.7.1 | GHSA-xpwp-rq3x-x6v7 |
| NuGet | recurly-api-client | >= 1.8.0, < 1.8.1 | 1.8.1 | GHSA-xpwp-rq3x-x6v7 |