CVE-2025-24875 — SameSite Defense in Depth not applied for some cookies in SAP Commerce
SAP Commerce, by default, sets certain cookies with the SameSite attribute configured to None (SameSite=None). This includes authentication cookies utilized in SAP Commerce Back…
Published: 2025-02-11 · CVSS: 6.8 · CVSS 3.1
SAP Commerce, by default, sets certain cookies with the SameSite attribute configured to None (SameSite=None). This includes authentication cookies utilized in SAP Commerce Backoffice. Applying this setting reduces defense in depth against CSRF and may lead to future compatibility issues.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7