PT-2024-20859 · Unknown · 3Dsecure 2.0

Published 2024-09-11 · Updated 2024-10-22 · CVE-2024-25284

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions 3DSecure 2.0 version 3DS Authorization Method

Description The issue concerns multiple reflected Cross-Site Scripting (XSS) vulnerabilities in the 3DS Authorization Method of 3DSecure 2.0. This vulnerability allows reflected XSS via the threeDSMethodData parameter in the threeDsMethod.jsp endpoint.

Recommendations For 3DSecure 2.0 version 3DS Authorization Method, consider restricting access to the threeDSMethodData parameter in the threeDsMethod.jsp endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2024-25284

Affected Products

3Dsecure 2.0

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-25284 · Security Note
• https://twitter.com/CVEnew/status/1843889517658616201 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1834080867968241687 · Twitter Post
• https://twitter.com/buaqbot/status/1834062905282547886 · Twitter Post
• https://t.me/cvedetector/7422 · Telegram Post