PT-2024-20861 · Unknown · 3Dsecure 2.0

Published 2024-09-10 · Updated 2024-10-22 · CVE-2024-25286

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions 3DSecure 2.0 version 3DS Authorization Method

Description A Cross-Site Request Forgery (CSRF) issue was identified in the Authorization Method of 3DSecure 2.0, allowing for potential exploitation via modified Origin and Referer HTTP headers.

Recommendations For 3DSecure 2.0 version 3DS Authorization Method, consider implementing proper validation of the Origin and Referer HTTP headers to prevent CSRF attacks. As a temporary workaround, restrict access to the Authorization Method until a patch is available.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2025-03588

CVE-2024-25286

Affected Products

3Dsecure 2.0

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-25286 · Security Note
• https://bdu.fstec.ru/vul/2025-03588 · Security Note
• https://twitter.com/VulmonFeeds/status/1834082380765712630 · Twitter Post
• https://seclists.org/fulldisclosure/2024/Sep/31 · Note
• https://twitter.com/CVEnew/status/1843889519671816572 · Twitter Post
• https://t.me/cvedetector/7424 · Telegram Post
• https://twitter.com/buaqbot/status/1834103252092129365 · Twitter Post