CVE-2025-24874

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

SAP Commerce (Backoffice) uses the deprecated X-FRAME-OPTIONS header to protect against clickjacking. While this protection remains effective now, it may not be the case in the future as browsers might discontinue support for this header in favor of the frame-ancestors CSP directive. Hence, clickjacking could become possible then, and lead to exposure and modification of sensitive information.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-1021

Affected software

No affected versions have been published.

Timeline

Published: Feb 11, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-248756.8SAP Commerce, by default, sets certain cookies with the SameSite attribute configured to None (SameSite=None). This includes authentication CVE-2025-248768.1The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code an a CVE-2025-24886.1Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Profelis Informatics SambaBox a CVE-2025-248825.2regclient is a Docker and OCI Registry Client in Go. A malicious registry could return a different digest for a pinned manifest without dete CVE-2025-248838.7go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced to shutdown/crash us CVE-2025-248845.1kube-audit-rest is a simple logger of mutation/creation requests to the k8s api. If the "full-elastic-stack" example vector configuration wa CVE-2025-248857.6pwn.college is an education platform to learn about, and practice, core cybersecurity concepts in a hands-on fashion. Missing access control CVE-2025-248867.7pwn.college is an education platform to learn about, and practice, core cybersecurity concepts in a hands-on fashion. Incorrect symlink chec CVE-2025-248876.3OpenCTI is an open-source cyber threat intelligence platform. In versions starting from 6.4.8 to before 6.4.10, the allow/deny lists can be CVE-2025-248888.1The SecureDrop Client is a desktop application for journalists to communicate with sources and work with submissions on the SecureDrop Works CVE-2025-248894.5The SecureDrop Client is a desktop application for journalists to communicate with sources and work with submissions on the SecureDrop Works CVE-2025-24896.8Insecure information storage vulnerability in NTFS Tools version 3.5.1. Exploitation of this vulnerability could allow an attacker to know t