CVE-2024-25284

CVE-2024-25284 concerns RedSys 3DSecure 2.0, specifically the 3DS Authorization Method. The vulnerability is a reflected Cross‑Site Scripting (XSS) in the threeDSMethod.jsp endpoint, caused by lack of sanitization of the threeDSMethodData parameter. This allows an attacker to inject arbitrary scr...

3DSecure 2.0 3DS Authorization Method Cross Site Scripting

Product: 3DSecure 2.0 Manufacturer: Redsys Affected Versions: 3DSecure 2.0 3DS Authorization Method Tested Versions: 3DSecure 2.0 3DS Authorization Method Vulnerability Type: Cross-Site Scripting XSS Risk Level: Medium Solution Status: Not yet fixed Manufacturer Notification: 2024-01-17 Solution...