CVE-2024-25284

The 3DSecure 2.0 3DS Authorization Method component by Redsys is vulnerable to reflected Cross-Site Scripting (XSS) . The root cause is the lack of sanitization for the threeDSMethodData parameter in the threeDsMethod.jsp endpoint, which allows attackers to inject arbitrary web scripts by manipul...

3DSecure 2.0 3DS Authorization Method Cross Site Scripting

Product: 3DSecure 2.0 Manufacturer: Redsys Affected Versions: 3DSecure 2.0 3DS Authorization Method Tested Versions: 3DSecure 2.0 3DS Authorization Method Vulnerability Type: Cross-Site Scripting XSS Risk Level: Medium Solution Status: Not yet fixed Manufacturer Notification: 2024-01-17 Solution...