CVE-2025-24875

Description

SAP Commerce, by default, sets certain cookies with the SameSite attribute configured to None (SameSite=None). This includes authentication cookies utilized in SAP Commerce Backoffice. Applying this setting reduces defense in depth against CSRF and may lead to future compatibility issues.

References

https://url.sap/sapsecuritypatchday

https://me.sap.com/notes/3555364

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3