CVE-2024-25285

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-25285
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVSS

No CVSS.

References

No reference.

Configurations

No configuration.

History

22 Oct 2024, 21:15

Type Values Removed Values Added
References
  • {'url': 'https://pagosonline.redsys.es/funcionalidades-autenticacion3DS.html', 'source': 'cve@mitre.org'}
  • {'url': 'https://seclists.org/fulldisclosure/2024/Sep/30', 'source': 'cve@mitre.org'}
CWE CWE-79
Summary
  • (es) 3DSecure 2.0 permite el secuestro de acciones de formularios a través de threeDsMethod.jsp?threeDSMethodData= o el parámetro threeDSMethodNotificationURL. El sitio web de destino para el envío de un formulario se puede modificar.
Summary (en) 3DSecure 2.0 allows form action hijacking via threeDsMethod.jsp?threeDSMethodData= or the threeDSMethodNotificationURL parameter. The destination web site for a form submission can be modified. (en) Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVSS v2 : unknown
v3 : 6.1 		v2 : unknown
v3 : unknown

09 Oct 2024, 16:35

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.1
Summary
  • (es) 3DSecure 2.0 permite el secuestro de acciones de formularios a través de threeDsMethod.jsp?threeDSMethodData= o el parámetro threeDSMethodNotificationURL. El sitio web de destino para el envío de un formulario se puede modificar.
CWE CWE-79

09 Oct 2024, 04:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-10-09 04:15

Updated : 2024-10-22 21:15

NVD link : CVE-2024-25285

Mitre link : CVE-2024-25285

CVE.ORG link : CVE-2024-25285

JSON object : View

Products Affected

No product.

CWE

No CWE.