PT-2025-6132 · Sap · Sap Commerce

Published 2025-02-11 · Updated 2025-02-12 · CVE-2025-24874

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: SAP Commerce (Backoffice) (affected versions not specified)

Description: The issue concerns the use of the deprecated X-FRAME-OPTIONS header to protect against clickjacking. Although this protection is currently effective, it may not remain so in the future if browsers discontinue support for this header in favor of the frame-ancestors CSP directive. This could potentially lead to clickjacking, resulting in the exposure and modification of sensitive information.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

CVE-2025-24874

Affected Products

Sap Commerce

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-24874 · Security Note
• https://url.sap/sapsecuritypatchday · Note
• https://twitter.com/CVEnew/status/1889116921863246318 · Twitter Post
• https://twitter.com/cybercronai/status/1889653346094518673 · Twitter Post
• https://me.sap.com/notes/3559510 · Note
• https://t.me/cvedetector/17622 · Telegram Post