Vulnerability CVE-2024-25285
Published: 2024-10-09

Description:
3DSecure 2.0 allows form action hijacking via threeDsMethod.jsp?threeDSMethodData= or the threeDSMethodNotificationURL parameter. The destination web site for a form submission can be modified.

 References:
https://pagosonline.redsys.es/funcionalidades-autenticacion3DS.html
https://seclists.org/fulldisclosure/2024/Sep/30
Copyright 2026, cxsecurity.com

 

Back to Top