CVE-2025-24875 MEDIUM

CVE-2025-24875: SameSite Defense in Depth not applied for some cookies in SAP Commerce

Vendor Sap_Se
Product SAP Commerce
Weakness CWE-352 · CSRF
Published February 11, 2025
Last update February 18, 2025
View on NVD All CVEs

CVSS base score

6.8/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

SAP Commerce, by default, sets certain cookies with the SameSite attribute configured to None (SameSite=None). This includes authentication cookies utilized in SAP Commerce Backoffice. Applying this setting reduces defense in depth against CSRF and may lead to future compatibility issues.

Key dates

02Disclosure timeline

February 11, 2025 CVE published
February 18, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2021-24162 Responsive Menu < 4.0.4 - CSRF to Settings Update CVE-2025-12586 Conditional Maintenance Mode for WordPress <= 1.0.0 - Cross-Site Request Forgery CVE-2025-25074 WordPress WP Social Stream plugin <= 1.1 - CSRF to Stored XSS vulnerability CVE-2024-35636 WordPress Uploadcare File Uploader and Adaptive Delivery plugin <= 3.0.11 - Cross Site Request Forgery (CSRF) vulnerability CVE-2025-27003 WordPress Quick Paypal Payments Plugin <= 5.7.46 - Cross Site Request Forgery (CSRF) vulnerability