Vulnerability CVE-2024-25283
Published: 2024-10-09

Description:
3DSecure 2.0 allows reflected XSS in the 3DS Authorization Challenge via a modified params parameter in a /rest/online request with a /redirect?action=challenge&txn= substring.

 References:
https://pagosonline.redsys.es/funcionalidades-autenticacion3DS.html
https://seclists.org/fulldisclosure/2024/Sep/28
Copyright 2026, cxsecurity.com

 

Back to Top